Events Made Easy <= 2.3.14 - Subscriber+ SQLi

2023-03-2200:00:00

wpvulndb

wordpress

security

sqli

0.001 Low

EPSS

Percentile

31.2%

JSON

The plugin does not properly sanitise and escape the search_name parameter before using it in a SQL statement via the eme_recurrences_list AJAX action, leading to a SQL injection exploitable by any authenticated users, such as subscriber

Open the URL below while being on the blog as subscriber user

https://example.com/wp-admin/admin-ajax.php?action=eme_recurrences_list&search_name=1'{+}AND{+}(SELECT+1+FROM+(SELECT(SLEEP(0.5)))a)-{-}+{-}

References

www.tenable.com/security/research/tra-2023-2

0.001 Low

EPSS

Percentile

31.2%

JSON

Related for WPEX-ID:6DB977AA-82DB-49C2-9A42-00B519017BC0