PT-2024-22392 · Unknown · Puneethreddyhc Event Management

Sospiro · Published 2024-04-26 · Updated 2025-05-14 · CVE-2024-28322

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PuneethReddyHC Event Management version 1.0

Description The issue allows attackers to run arbitrary SQL commands via the event id parameter in a crafted POST request to the "/event-management-master/backend/register.php" API endpoint. This enables attackers to potentially extract or modify sensitive data.

Recommendations For version 1.0, consider disabling the event id parameter in the "/event-management-master/backend/register.php" API endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using the event id parameter in crafted POST requests to this endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-28322

Affected Products

Puneethreddyhc Event Management

References · 9

• 🔥 https://packetstormsecurity.com/files/177841/Event-Management-1.0-SQL-Injection.html · Exploit
• 🔥 https://github.com/Sospiro014/zday1/blob/main/event-managment.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-28322 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28322 · Vendor Advisory
• https://t.me/cvenotify/122119 · Telegram Post
• https://t.me/cvenotify/78223 · Telegram Post
• https://t.me/cvenotify/78388 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1784019877805649983 · Twitter Post
• https://twitter.com/CVEnew/status/1783987436915249529 · Twitter Post