CVE-2017-1002018

EUVD-2017-1633
Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and attendees.php code do not sanitize input, this allows for blind SQL injection via the event parameter.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 90%
Affected Products (NVD)
VendorProductVersion
eventr_projecteventr
1.02.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.vapidlabs.com/advisory.php?v=192
https://wordpress.org/plugins/eventr/
http://www.vapidlabs.com/advisory.php?v=192
https://wordpress.org/plugins/eventr/