CVE-2024-3433 - Vulnerability Details - OpenCVE

A vulnerability classified as problematic has been found in PuneethReddyHC Event Management 1.0. Affected is an unknown function of the file /backend/register.php. The manipulation of the argument event_id/full_name/email/mobile/college/branch leads to cross site scripting. It is possible to launch the attack remotely. VDB-259614 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://packetstormsecurity.com/files/177841/Event-Management-1.0-SQL-Injection.html
https://vuldb.com/?ctiid.259614
https://vuldb.com/?id.259614
https://vuldb.com/?submit.307744

History

No history.

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2024-04-07T23:00:05.894Z

Updated: 2024-08-19T17:06:28.466Z

Reserved: 2024-04-07T06:25:28.601Z

Link: CVE-2024-3433

Vulnrichment

Updated: 2024-08-01T20:12:06.912Z

NVD

Status : Awaiting Analysis

Published: 2024-04-07T23:15:08.743

Modified: 2024-11-21T09:29:35.767

Link: CVE-2024-3433

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-3433", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2024-04-07T06:25:28.601Z", "datePublished": "2024-04-07T23:00:05.894Z", "dateUpdated": "2024-08-19T17:06:28.466Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2024-04-07T23:00:05.894Z"}, "title": "PuneethReddyHC Event Management register.php cross site scripting", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Cross Site Scripting"}]}], "affected": [{"vendor": "PuneethReddyHC", "product": "Event Management", "versions": [{"version": "1.0", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability classified as problematic has been found in PuneethReddyHC Event Management 1.0. Affected is an unknown function of the file /backend/register.php. The manipulation of the argument event_id/full_name/email/mobile/college/branch leads to cross site scripting. It is possible to launch the attack remotely. VDB-259614 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "de", "value": "Es wurde eine problematische Schwachstelle in PuneethReddyHC Event Management 1.0 entdeckt. Betroffen hiervon ist ein unbekannter Ablauf der Datei /backend/register.php. Durch die Manipulation des Arguments event_id/full_name/email/mobile/college/branch mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk."}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N"}}], "timeline": [{"time": "2024-04-07T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2024-04-07T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2024-04-07T08:30:37.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "SoSPiro (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.259614", "name": "VDB-259614 | PuneethReddyHC Event Management register.php cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.259614", "name": "VDB-259614 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.307744", "name": "Submit #307744 | PuneethReddyHC Event Management 1.0 SQL Injection", "tags": ["third-party-advisory"]}, {"url": "https://packetstormsecurity.com/files/177841/Event-Management-1.0-SQL-Injection.html", "tags": ["related"]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:12:06.912Z"}, "title": "CVE Program Container", "references": [{"url": "https://vuldb.com/?id.259614", "name": "VDB-259614 | PuneethReddyHC Event Management register.php cross site scripting", "tags": ["vdb-entry", "technical-description", "x_transferred"]}, {"url": "https://vuldb.com/?ctiid.259614", "name": "VDB-259614 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required", "x_transferred"]}, {"url": "https://vuldb.com/?submit.307744", "name": "Submit #307744 | PuneethReddyHC Event Management 1.0 SQL Injection", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "https://packetstormsecurity.com/files/177841/Event-Management-1.0-SQL-Injection.html", "tags": ["related", "x_transferred"]}]}, {"affected": [{"vendor": "puneethreddyhc", "product": "event_management", "cpes": ["cpe:2.3:a:puneethreddyhc:event_management:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "1.0", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-19T17:05:35.702540Z", "id": "CVE-2024-3433", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-19T17:06:28.466Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://vuldb.com/?id.259614", "name": "VDB-259614 | PuneethReddyHC Event Management register.php cross site scripting", "tags": ["vdb-entry", "technical-description", "x_transferred"]}, {"url": "https://vuldb.com/?ctiid.259614", "name": "VDB-259614 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required", "x_transferred"]}, {"url": "https://vuldb.com/?submit.307744", "name": "Submit #307744 | PuneethReddyHC Event Management 1.0 SQL Injection", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "https://packetstormsecurity.com/files/177841/Event-Management-1.0-SQL-Injection.html", "tags": ["related", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:12:06.912Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-3433", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-19T17:05:35.702540Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:puneethreddyhc:event_management:*:*:*:*:*:*:*:*"], "vendor": "puneethreddyhc", "product": "event_management", "versions": [{"status": "affected", "version": "1.0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-19T17:06:23.227Z"}}], "cna": {"title": "PuneethReddyHC Event Management register.php cross site scripting", "credits": [{"lang": "en", "type": "reporter", "value": "SoSPiro (VulDB User)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N"}}], "affected": [{"vendor": "PuneethReddyHC", "product": "Event Management", "versions": [{"status": "affected", "version": "1.0"}]}], "timeline": [{"lang": "en", "time": "2024-04-07T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2024-04-07T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2024-04-07T08:30:37.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.259614", "name": "VDB-259614 | PuneethReddyHC Event Management register.php cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.259614", "name": "VDB-259614 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.307744", "name": "Submit #307744 | PuneethReddyHC Event Management 1.0 SQL Injection", "tags": ["third-party-advisory"]}, {"url": "https://packetstormsecurity.com/files/177841/Event-Management-1.0-SQL-Injection.html", "tags": ["related"]}], "descriptions": [{"lang": "en", "value": "A vulnerability classified as problematic has been found in PuneethReddyHC Event Management 1.0. Affected is an unknown function of the file /backend/register.php. The manipulation of the argument event_id/full_name/email/mobile/college/branch leads to cross site scripting. It is possible to launch the attack remotely. VDB-259614 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "de", "value": "Es wurde eine problematische Schwachstelle in PuneethReddyHC Event Management 1.0 entdeckt. Betroffen hiervon ist ein unbekannter Ablauf der Datei /backend/register.php. Durch die Manipulation des Arguments event_id/full_name/email/mobile/college/branch mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Cross Site Scripting"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2024-04-07T23:00:05.894Z"}}}, "cveMetadata": {"cveId": "CVE-2024-3433", "state": "PUBLISHED", "dateUpdated": "2024-08-19T17:06:28.466Z", "dateReserved": "2024-04-07T06:25:28.601Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2024-04-07T23:00:05.894Z", "assignerShortName": "VulDB"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "A vulnerability classified as problematic has been found in PuneethReddyHC Event Management 1.0. Affected is an unknown function of the file /backend/register.php. The manipulation of the argument event_id/full_name/email/mobile/college/branch leads to cross site scripting. It is possible to launch the attack remotely. VDB-259614 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en PuneethReddyHC Event Management 1.0 y se ha clasificado como problem\u00e1tica. Una funci\u00f3n desconocida del archivo /backend/register.php es afectada por esta vulnerabilidad. La manipulaci\u00f3n del argumento event_id/full_name/email/mobile/college/branch conduce a cross-site scripting. Es posible lanzar el ataque de forma remota. VDB-259614 es el identificador asignado a esta vulnerabilidad. NOTA: Se contact\u00f3 primeramente con el proveedor sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2024-3433", "lastModified": "2024-11-21T09:29:35.767", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}]}, "published": "2024-04-07T23:15:08.743", "references": [{"source": "cna@vuldb.com", "url": "https://packetstormsecurity.com/files/177841/Event-Management-1.0-SQL-Injection.html"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.259614"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.259614"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.307744"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://packetstormsecurity.com/files/177841/Event-Management-1.0-SQL-Injection.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://vuldb.com/?ctiid.259614"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://vuldb.com/?id.259614"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://vuldb.com/?submit.307744"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "cna@vuldb.com", "type": "Secondary"}]}