WordPress Spider Event Calendar Plugin 1.3.0 – Multiple Vulnerabilities
Janek Vind “waraxe” reports multiple Vulnerability in WordPress Spider Event Calender Plugin
Details
Spider Event Calendar Plugin for WordPress contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to certain functions in the calendar_functions.php script not properly sanitizing user-supplied input. This includes input passed via the ‘order_by’ parameter to the show_spider_calendar() function, the ‘calendar_id’ and ‘order_by’ parameters to the show_spider_event() function, the ‘id’ parameter to the spider_calendar_published() and published_spider_event() functions, and the ‘calendar_id’ parameter to the edit_spider_event() and add_spider_event() functions. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data
Recommended Action:
Disable or Replace plugin until update becomes available.
Info
Platform: WordPress
Type: Plugin
Plugin: Spider Event Calendar Plugin for WordPress
Vendor: http://wordpress.org/extend/plugins/spider-event-calendar/
Version: 1.3.0
Google Dork: inurl:/wp-content/plugins/spider-event-calendar

