CVE-2020-23980

Vulnerability

DesignMasterEvents Conference management version 1.0.0 contains a SQL injection vulnerability in the username field of the administrator login page (/admin/login.php). The application fails to sanitize user input before using it in a SQL query, allowing an attacker to inject arbitrary SQL commands. The vulnerability is present in the login form and does not require any special configuration to be reachable [1][2].

Exploitation

An attacker can exploit this vulnerability by submitting a crafted username payload such as admin' or '1' = '1'; -- - along with any password (e.g., vvv). The injected SQL statement modifies the query logic, causing the authentication check to succeed regardless of the actual password. The attacker only needs network access to the admin login page; no prior authentication or user interaction is required [1][2].

Impact

Successful exploitation results in authentication bypass, granting the attacker administrative access to the DesignMasterEvents CMS. With admin privileges, the attacker can fully control the conference management system, potentially leading to data disclosure, modification, or further compromise of the application and its data [1][2].

Mitigation

As of the publication date (2020-08-27), no official patch or fixed version has been released by the vendor. The application may be end-of-life or unmaintained. Users should consider migrating to a supported alternative or implementing input validation and parameterized queries as a workaround. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog [1][2].