Hi Events
Monthly
Server-side request forgery in Hi.Events (all versions prior to 1.11.1-beta) allows an authenticated platform user to exfiltrate responses from internal network services, including cloud metadata endpoints, by exploiting a time-of-check/time-of-use gap in webhook URL validation. The registration-time guard in NoInternalUrlRule is never repeated at dispatch, and Guzzle's default redirect-following allows a destination that answers with a redirect to a loopback or RFC-1918 address to cause the server to issue the secondary request. Critically, this is not blind SSRF: WebhookResponseHandlerService stores the response body and WebhookLogResource exposes it via the webhook logs API, enabling direct credential or secret exfiltration. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
SQL injection in Hi.Events open-source event management platform (versions 0.8.0-beta.1 through 1.7.0-beta) allows remote unauthenticated attackers to execute arbitrary SQL queries via unsanitized sort_by parameters passed to Eloquent's orderBy() method. The PostgreSQL backend supports stacked queries, enabling multi-statement injection. While CVSS 8.7 reflects high confidentiality impact and no authentication requirement, no public exploit code or CISA KEV listing exists at time of analysis. Vendor-released patch available in version 1.7.1-beta.
Stored cross-site scripting in Hi.Events through v1.10.0-beta allows authenticated event organizers to inject arbitrary JavaScript into public event pages by embedding the raw </script> sequence in an event title, which the application's JSON.stringify() serialization fails to encode safely when placed in inline script contexts. The payload executes in the browser of every visitor to the affected event page - including unauthenticated attendees and authenticated administrators - enabling session hijacking and privilege escalation from a low-privileged creator account. No public exploit has been identified at time of analysis; a vendor-released patch is available in v1.11.0-beta.
Hidden ticket purchase bypass in Hi.Events through v1.10.0-beta allows unauthenticated remote attackers to acquire VIP, invite-only, or discounted tickets withheld from public sale by referencing hidden ticket and price IDs directly in order creation API requests. The server fails to enforce ticket visibility rules at the API layer, relying only on UI-level concealment, and sequential integer ticket IDs allow systematic enumeration from observed visible IDs. No public exploit or active exploitation (KEV) has been identified at time of analysis, but the unauthenticated network vector and low complexity make opportunistic exploitation straightforward following disclosure.
Server-side request forgery in Hi.Events (all versions prior to 1.11.1-beta) allows an authenticated platform user to exfiltrate responses from internal network services, including cloud metadata endpoints, by exploiting a time-of-check/time-of-use gap in webhook URL validation. The registration-time guard in NoInternalUrlRule is never repeated at dispatch, and Guzzle's default redirect-following allows a destination that answers with a redirect to a loopback or RFC-1918 address to cause the server to issue the secondary request. Critically, this is not blind SSRF: WebhookResponseHandlerService stores the response body and WebhookLogResource exposes it via the webhook logs API, enabling direct credential or secret exfiltration. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
SQL injection in Hi.Events open-source event management platform (versions 0.8.0-beta.1 through 1.7.0-beta) allows remote unauthenticated attackers to execute arbitrary SQL queries via unsanitized sort_by parameters passed to Eloquent's orderBy() method. The PostgreSQL backend supports stacked queries, enabling multi-statement injection. While CVSS 8.7 reflects high confidentiality impact and no authentication requirement, no public exploit code or CISA KEV listing exists at time of analysis. Vendor-released patch available in version 1.7.1-beta.
Stored cross-site scripting in Hi.Events through v1.10.0-beta allows authenticated event organizers to inject arbitrary JavaScript into public event pages by embedding the raw </script> sequence in an event title, which the application's JSON.stringify() serialization fails to encode safely when placed in inline script contexts. The payload executes in the browser of every visitor to the affected event page - including unauthenticated attendees and authenticated administrators - enabling session hijacking and privilege escalation from a low-privileged creator account. No public exploit has been identified at time of analysis; a vendor-released patch is available in v1.11.0-beta.
Hidden ticket purchase bypass in Hi.Events through v1.10.0-beta allows unauthenticated remote attackers to acquire VIP, invite-only, or discounted tickets withheld from public sale by referencing hidden ticket and price IDs directly in order creation API requests. The server fails to enforce ticket visibility rules at the API layer, relying only on UI-level concealment, and sequential integer ticket IDs allow systematic enumeration from observed visible IDs. No public exploit or active exploitation (KEV) has been identified at time of analysis, but the unauthenticated network vector and low complexity make opportunistic exploitation straightforward following disclosure.