EDB-39066

functional

Eventum 2.3.4 - 'hostname' Remote Code Execution

view exploit source exploit_dbverifiedtype webappsauthor High-Tech Bridgepublished 2014-01-28catalog exploit_db

exploited CVEs (2)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2014-1632US	high8.1	10.5% (96th)	Exploit	2018-01-31
htdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter.
CVE-2014-1631US	high7.5	9.30% (95th)	Exploit	2018-01-31
Eventum before 2.3.5 allows remote attackers to reinstall the application via direct request to /setup/index.php.

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.