Exploitation Summary
EIP tracks 1 public exploit for CVE-2024-8275. PoCs published by p33d.
AI-analyzed exploit summary This PoC demonstrates a SQL injection vulnerability in The Events Calendar WordPress plugin by exploiting the unsanitized 'order' parameter in the tribe_has_next_event function. It includes a basic SQLi test and generates a sqlmap command for further exploitation.
Description
The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_next_event' function in all versions up to, and including, 6.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Only sites that have manually added tribe_has_next_event() will be vulnerable to this SQL injection.
Exploits (1)
This PoC demonstrates a SQL injection vulnerability in The Events Calendar WordPress plugin by exploiting the unsanitized 'order' parameter in the tribe_has_next_event function. It includes a basic SQLi test and generates a sqlmap command for further exploitation.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H