PT-2017-11007 · WordPress · Eventer

Larry W. Cashdollar + 1 · Published 2017-09-14 · Updated 2017-09-18 · CVE-2017-1002018

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wordpress plugin eventr version 1.02.2

Description The issue concerns a lack of input sanitization in the edit.php form and attendees.php code, allowing for blind SQL injection via the event parameter.

Recommendations For version 1.02.2, update to a newer version that addresses the input sanitization issue in the edit.php form and attendees.php code to prevent blind SQL injection via the event parameter.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-1002018

Affected Products

Eventer

References · 4

• 🔥 http://vapidlabs.com/advisory.php?v=192 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-1002018 · Security Note
• https://osv.dev/vulnerability/CVE-2017-1002018 · Vendor Advisory
• https://wordpress.org/plugins/eventr · Note