CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Control of Generation of Code ('Code Injection') vulnerability in Vollstart Event Tickets with Ticket Scanner event-tickets-with-ticket-scanner allows Code Injection.This issue affects Event Tickets with Ticket Scanner: from n/a through <= 2.8.5.
Explanation of Vulnerability in Simple Terms
Event Tickets with Ticket Scanner versions 2.8.5 and earlier contain a code injection vulnerability that allows attackers to execute arbitrary PHP code on the site without authentication. The vulnerability has a high attack complexity requirement but can affect confidentiality, integrity, and availability across the entire system. Site administrators should update immediately to a patched version.
What an attacker can do
Execute arbitrary PHP code on the site and take full control of the installation.
Potential impact on your site
Complete compromise of the site, including data theft, malware injection, and service disruption.
Conditions required to exploit
Network access; attack complexity is high, suggesting specific conditions or timing may be required.
Key dates
External resources
Related vulnerabilities
