CVE-2017-7719 SpiderCalendar <= 1.5.51 - SQL Injection
CriticalCVSS 9.8
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection in the Spider Event Calendar (aka spider-event-calendar) plugin before 1.5.52 for WordPress is exploitable with the order_by parameter to calendar_functions.php or widget_Theme_functions.php, related to front_end/frontend_functions.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| web-dorado spider event calendar | <= 1.5.51 | No fix listed |
| wordpress spider-event-calendar(WordPress) | < 1.5.52 | 1.5.52 |
References
- lists.openwall.net exploit mailing-list patch third-party-advisory
- 97656 third-party-advisory vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org