PT-2023-12632 · Sourcecodester · Sourcecodester Royale Event Management System

Mrempy · Publicado 2023-01-07 · Atualizado 2024-05-17 · CVE-2022-1102

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Royale Event Management System version 1.0

Description A problematic issue has been found in the system, affecting an unknown function of the file /royal event/companyprofile.php. The manipulation of the companyname, regno, companyaddress, or companyemail arguments leads to cross-site scripting. It is possible to launch the attack remotely.

Recommendations For SourceCodester Royale Event Management System version 1.0, consider disabling the affected function in the /royal event/companyprofile.php file until a patch is available. Restrict access to the companyprofile.php file to minimize the risk of exploitation. Avoid using the companyname, regno, companyaddress, or companyemail arguments in the affected file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2022-1102

Produtos afetados

Sourcecodester Royale Event Management System

Referências · 7

• https://vuldb.com/?id.195786 · Nota
• https://t.me/cvenotify/41510 · Publicação no Telegram
• https://vuldb.com/?ctiid.195786 · Nota
• https://sourcecodester.com/php/15238/event-management-system-project-php-source-code.html? · Nota
• https://t.me/cvenotify/41859 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-1102 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-1102 · Aviso do Fabricante