Template Engine Vulnerability in Saso Nikolov Event Tickets with Ticket Scanner
CVE-2024-52427

9.9CRITICAL

Key Information:

Vendor

Vollstart

Status
Event Tickets With Ticket Scanner
Vendor
CVE Published:
18 November 2024

Badges

👾 Exploit Exists

What is CVE-2024-52427?

The vulnerability identified involves an improper neutralization of special elements used in a template engine within the Saso Nikolov Event Tickets with Ticket Scanner plugin. This flaw facilitates Server Side Include (SSI) injection attacks that could allow an unauthorized user to execute commands on the server. The affected versions of the plugin range from an unspecified version up to 2.3.11, making it crucial for users to review their installations and apply security measures to mitigate potential exploitation risks.

Affected Version(s)

Event Tickets with Ticket Scanner 0 <= 2.3.11

References

https://patchstack.com/database/Wordpress/Plugin/event-ti...
vdb-entry

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

.