Description
Eventum before 2.3.5 allows remote attackers to reinstall the application via direct request to /setup/index.php.
Exploits (2)
exploitdb
WRITEUP
VERIFIED
by High-Tech Bridge · textwebappsphp
https://www.exploit-db.com/exploits/39066
exploitdb
WRITEUP
VERIFIED
by High-Tech Bridge · textwebappsphp
https://www.exploit-db.com/exploits/39065
References (4)
Core 4
Core References
Exploit, Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/530891/100/0/threaded
Patch, Third Party Advisory x_refsource_confirm
http://bazaar.launchpad.net/~eventum-developers/eventum/trunk/revision/4666
Exploit, Third Party Advisory x_refsource_misc
https://www.htbridge.com/advisory/HTB23198
Exploit, Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugs.launchpad.net/eventum/+bug/1271499
Scores
CVSS v3
7.5
EPSS
0.2760
EPSS Percentile
96.5%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Details
CWE
CWE-275
Status
published
Products (1)
eventum_project/eventum
< 2.3.5
Published
Jan 31, 2018
Tracked Since
Feb 18, 2026