CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Deserialization of Untrusted Data vulnerability in Vollstart Event Tickets with Ticket Scanner event-tickets-with-ticket-scanner allows Server Side Include (SSI) Injection.This issue affects Event Tickets with Ticket Scanner: from n/a through <= 2.3.11.
Explanation of Vulnerability in Simple Terms
Event Tickets with Ticket Scanner versions up to 2.3.11 contain a privilege escalation vulnerability. An authenticated user with low privileges can modify data across the application and affect system availability. The vulnerability has a wide attack surface due to changed scope, meaning impacts extend beyond the vulnerable component itself.
What an attacker can do
Modify application data, read sensitive information, and disrupt service availability.
Potential impact on your site
Authenticated users can escalate privileges to alter event data, access confidential information, and cause downtime.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
