bigtree-events SQL注入漏洞

bigtree-events is an event extension for BigTree CMS by Tim Buckingham, an individual developer. A SQL injection vulnerability exists in bigtree-events, which stems from the function getRandomFeaturedEventByDate/ in the file classes/events.php...

CVE-2018-25076: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability classified as critical was found in Events Extension on BigTree. Affected by this vulnerability is the function getRandomFeaturedEventByDate/getUpcomingFeaturedEventsInCategoriesWithSubcategories/recacheEvent/searchResults of the file classes/events.php. The manipulation leads to...