WordPress Spider Event Calendar Plugin 1.3.0 – Multiple Vulnerabilities

Janek Vind “waraxe” reports multiple Vulnerability in WordPress Spider Event Calender Plugin

Details

Spider Event Calendar Plugin for WordPress contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to certain functions in the calendar_functions.php script not properly sanitizing user-supplied input. This includes input passed via the ‘order_by’ parameter to the show_spider_calendar() function, the ‘calendar_id’ and ‘order_by’ parameters to the show_spider_event() function, the ‘id’ parameter to the spider_calendar_published() and published_spider_event() functions, and the ‘calendar_id’ parameter to the edit_spider_event() and add_spider_event() functions. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data

Recommended Action:

Disable or Replace plugin until update becomes available.

Info

Platform: WordPress
Type: Plugin
Plugin: Spider Event Calendar Plugin for WordPress
Vendor: http://wordpress.org/extend/plugins/spider-event-calendar/
Version: 1.3.0
Google Dork: inurl:/wp-content/plugins/spider-event-calendar

WordPress FuneralPress Plugin XSS Vulnerability

robarmstrong.te71@gmail.com reports XSS Vulnerability in WordPress FuneralPress Plugin

Details

There appears to be some basic xss protection on form submissions using <textarea name=”message”> and code injected via this element is not served up on the guestbook admin page.

Despite this, scripts injected via an iframe or embedded svg will be executed by anyone viewing the guestbook at http://site/obituaries/?id=1&f=guestbook on the condition that the post is approved by the site administrator. The chances of an administrator approving a malicious message are increased if some normal-looking text is inserted above the malicious code, resulting in a legitimate looking “Message Preview” field on the admin page.

Recommended Action:

Remove plugin

Info

Platform: WordPress
Type: Plugin
Plugin: Wordpress FuneralPress
Vendor: http://wpfuneralpress.com/
Version: 1.1.6
Google Dork: inurl:/obituaries