PT-2023-12632 · Sourcecodester · Sourcecodester Royale Event Management System

Mrempy · Published 2023-01-07 · Updated 2024-05-17 · CVE-2022-1102

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Royale Event Management System version 1.0

Description A problematic issue has been found in the system, affecting an unknown function of the file /royal event/companyprofile.php. The manipulation of the companyname, regno, companyaddress, or companyemail arguments leads to cross-site scripting. It is possible to launch the attack remotely.

Recommendations For SourceCodester Royale Event Management System version 1.0, consider disabling the affected function in the /royal event/companyprofile.php file until a patch is available. Restrict access to the companyprofile.php file to minimize the risk of exploitation. Avoid using the companyname, regno, companyaddress, or companyemail arguments in the affected file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-1102

Affected Products

Sourcecodester Royale Event Management System

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-1102 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1102 · Vendor Advisory
• https://vuldb.com/?id.195786 · Note
• https://t.me/cvenotify/41510 · Telegram Post
• https://vuldb.com/?ctiid.195786 · Note
• https://sourcecodester.com/php/15238/event-management-system-project-php-source-code.html? · Note
• https://t.me/cvenotify/41859 · Telegram Post