CVE-2014-1632

This is a weakness in Eventum’s installation page that can let someone send harmful instructions to the server. It is like leaving a building’s maintenance control panel accessible from outside, allowing a stranger to change how the building operates.

This matters to you if you run Eventum, especially an installation older than version 2.3.5. An attacker does not need an account or anyone to click anything; it is only a risk if the setup page is reachable by the attacker.

Public attack code is available, which makes this an amber-level issue that should be addressed promptly. It is not listed in CISA’s catalog of vulnerabilities known to be actively exploited, but an exposed setup page creates a direct route to application takeover.

Confirm the deployed Eventum version and determine whether htdocs/setup/index.php is reachable from untrusted networks. Upgrade all affected installations to Eventum 2.3.5 or later; the findings provide one fixed version and do not identify separate maintenance branches or upgrade-breaking changes.

If the upgrade must wait, block external access to the setup page at the web server or network boundary, permitting it only for trusted administrators when genuinely required. Review web-server and Eventum logs for unusual requests to the setup page and inspect Eventum files and configuration for unexpected changes. CISA has not assigned a KEV remediation due date because this CVE is not listed in KEV.

CVE-2014-1632 is rated CVSS 8.1 High (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The issue is CWE-275 and permits unauthenticated, network-based arbitrary PHP code injection and execution through the hostname parameter in htdocs/setup/index.php on Eventum versions before 2.3.5. Three public exploits are known. It is not in CISA KEV; EPSS estimates a 10.5% likelihood and reports a falling trend.