An HTML injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via the msg parameter to /event-management/index.php. An attacker can leverage this vulnerability in order to change the visibility of the website. Once the target user clicks on a given link he will display the content of the HTML code of the attacker's choice.
References
| Link | Resource |
|---|---|
| https://github.com/TheHackingRabbi/CVE-2021-42663 | Exploit Third Party Advisory |
| https://www.sourcecodester.com/php/14241/online-event-booking-and-reservation-system-phpmysql.html | Product Third Party Advisory |
| https://github.com/TheHackingRabbi/CVE-2021-42663 | Exploit Third Party Advisory |
| https://www.sourcecodester.com/php/14241/online-event-booking-and-reservation-system-phpmysql.html | Product Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 06:27
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/TheHackingRabbi/CVE-2021-42663 - Exploit, Third Party Advisory | |
| References | () https://www.sourcecodester.com/php/14241/online-event-booking-and-reservation-system-phpmysql.html - Product, Third Party Advisory |
Information
Published : 2021-11-05 13:15
Updated : 2024-11-21 06:27
NVD link : CVE-2021-42663
Mitre link : CVE-2021-42663
CVE.ORG link : CVE-2021-42663
JSON object : View
Products Affected
online_event_booking_and_reservation_system_project
- online_event_booking_and_reservation_system
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')