EventPrime < 3.3.6 - Unauthenticated Event Access

2023-12-2900:00:00

Miguel Santareno

eventprime

password-protected

private event

url exploit

unauthenticated access

AI Score

7.3

Confidence

Low

EPSS

0.001

Percentile

17.0%

JSON

Description The plugin lacks authentication and authorization, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id/event name.

1. Create a password-protected event or a private event then publish it.
2. Access to the URL on a private browser and you will be able to see the password-protected or private event.
3. https://www.example.com/index.php/event/{{EVENT-ID}}/