MALWARELIST.net – Your Information Security Source

Vulnerability: Multiple vulnerabilities in WordPress Spider Calendar

Danger: middle
Number of vulnerabilities: 2
Impact: Cross Site Scripting
Unauthorized manipulation of data
Affected products: WordPress Spider Calendar Plugin 1.x

Affected versions: WordPress Spider Calendar 1.0.1, possibly earlier.

Description:

The vulnerability allows a remote user to execute arbitrary SQL commands in the application database.

1. The vulnerability is caused due to insufficient input validation in the parameter “date” in the script front_end / spidercalendarbig.php. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

2. The vulnerability is caused due to insufficient input validation in the parameter “calendar_id” in script front_end / spidercalendarbig_seemore.php (when the parameter “ev_ids” ID is available events). This can be exploited to execute arbitrary SQL commands in the application database.

Manufacturer URL: http://web-dorado.com/

Solution: The way to eliminate the vulnerability does not exist at present.

Links:

http://packetstormsecurity.org/files/117078/WordPress-Spider-1.0.1-SQL-Injection-XSS.html