Timely All-in-One Events Calendar, a557ea43720d1c85c2e19afad6935a524a2e4b0e

CVE, Research URL: a557ea43720d1c85c2e19afad6935a524a2e4b0e
Home page URL: Security reports for Timely All-in-One Events Calendar
Application: Timely All-in-One Events Calendar
Published on: Mar 07, 2013
Research Description: Timely All-in-One Events Calendar [all-in-one-event-calendar] < 1.10 (closed) All-in-One Events Calendar < 1.10 - SQL Injection The All-in-One Events Calendar plugin for WordPress is vulnerable to SQL Injection via the “ai1ec_cat_ids”, “ai1ec_post_ids” and “ai1ec_tag_ids” parameters in versions up to, and including, 1.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected versions: max 1.10.
Status: vulnerable