PT-2024-35267

CVE-2024-52427

Published

2024-11-18

Updated

2024-11-20

Description by

CVSS 3.1

9.9

Critical

MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Event Tickets with Ticket Scanner versions 2.3.11 and earlier

Description The issue affects Event Tickets with Ticket Scanner, allowing Server Side Include (SSI) Injection due to improper neutralization of special elements used in a template engine. This can lead to security risks.

Recommendations For versions 2.3.11 and earlier, update to version 2.3.12 to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the application to minimize the risk of exploitation.

Exploitability

Fix

Impacts

Researchers

Hakiduck

Vendors

Affected products

Weakness enumeration

CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

CWE-82: Improper Neutralization of Script in Attributes of IMG Tags in a Web Page

Related identifiers