|
Description
|
|
Some vulnerabilities have been reported in the Community Events Plugin for WordPress, which can be exploited by malicious people to conduct SQL injection attacks.
1) Input passed via the "eventyear" GET parameter to community-events.php (when "page_id" is set to any number) is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
2) Certain unspecified input is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
The vulnerabilities are reported in version 1.3.5. Prior versions may also be affected.
|
