PT-2024-26411 · Unknown · Campcodes Online Event Management System

Ssl_Seven_Security Lab_Wangzhiqiang_Xiaozilong · Published 2024-04-09 · Updated 2024-05-17 · CVE-2024-3526

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Campcodes Online Event Management System version 1.0

Description A vulnerability has been found in the system, classified as problematic, affecting an unknown functionality of the file index.php. The manipulation of the msg argument leads to cross site scripting. The attack can be launched remotely.

Recommendations For version 1.0, consider restricting access to the index.php file or disabling the functionality that manipulates the msg argument until a patch is available. As a temporary workaround, avoid using the msg argument in the affected functionality to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-3526

Affected Products

Campcodes Online Event Management System

References · 8

• 🔥 https://github.com/E1CHO/cve_hub/blob/main/Online%20Event%20Management%20System/Online%20Event%20Management%20System%20-%20vuln%205.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2024-3526 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-3526 · Security Note
• https://t.me/cvenotify/76277 · Telegram Post
• https://vuldb.com/?ctiid.259897 · Note
• https://vuldb.com/?id.259897 · Note
• https://twitter.com/CVEnew/status/1777890993330917656 · Twitter Post
• https://vuldb.com/?submit.312508 · Note