Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2024-44727: Event Management System SQL Injection in Login Page
CVE-2024-44727 · published 2 years ago
Summary
The Event Management System's login page is vulnerable to a security risk that could allow an attacker to access sensitive data. This means that a hacker could potentially gain unauthorized access to the system by manipulating the username field. To protect your data, update the system to a secure version or patch the vulnerable file /event/admin/login.php.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| angeljudesuarez | event_management_system |
1.0 cpe:2.3:a:angeljudesuarez:event_management_system:1.0:*:*:*:*:*:*:* |
Original advisory text
Sourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/login.php.
Sourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/login.php.
References
- https://github.com/AslamMahi/CVE-Aslam-Mahi/blob/main/Sourcecodehero%20Event%20M... Exploit Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-89SQL Injection
Timeline
Published5 Sep 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-44727 · NVD
Track software like this
Free during beta