PT-2017-11008 · WordPress · Eventer

Larry W. Cashdollar + 1 · Publicado 2017-09-14 · Atualizado 2017-09-18 · CVE-2017-1002019

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wordpress plugin eventr version 1.02.2

Description The issue arises from insufficient input sanitization in the edit.php form and event form.php code, allowing for blind SQL injection attacks via the event parameter.

Recommendations For version 1.02.2, update the plugin to a version that addresses the input sanitization issue in the edit.php form and event form.php code, specifically ensuring proper handling of the event parameter to prevent SQL injection attacks.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-1002019

Produtos afetados

Eventer

Referências · 4

• 🔥 http://vapidlabs.com/advisory.php?v=192 · Exploit
• https://osv.dev/vulnerability/CVE-2017-1002019 · Aviso do Fabricante
• https://wordpress.org/plugins/eventr · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-1002019 · Nota de Segurança