PT-2020-15612 · Designmasterevents · Designmasterevents Conference Management

Thelastvvv · Published 2020-08-27 · Updated 2020-09-01 · CVE-2020-23980

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DesignMasterEvents Conference management version 1.0.0

Description The issue allows SQL Injection via the username field on the administrator login page.

Recommendations For DesignMasterEvents Conference management version 1.0.0, avoid using the username field in the administrator login page until the issue is resolved. As a temporary workaround, consider restricting access to the administrator login page to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-23980

Affected Products

Designmasterevents Conference Management

References · 4

• 🔥 https://cxsecurity.com/issue/WLB-2020030177 · Exploit
• 🔥 https://packetstormsecurity.com/files/156959/DesignMasterEvents-CMS-1.0-SQL-Injection-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-23980 · Security Note
• https://osv.dev/vulnerability/CVE-2020-23980 · Vendor Advisory