Events <= 2.3.4 - Authenticated SQL Injection

Description

Type user access: administrator user.
$_GET[‘edit_event’] is not escaped.

File / Code:

Path Request: /wp-content/plugins/wp-events/wp-events.php

Line : 450 – 468

if ( isset( $_GET['edit_event'] ) ) {
$event_edit_id = esc_attr( $_GET['edit_event'] );
}

...
$edit_event = $wpdb->get_row( "SELECT * FROM `{$wpdb->prefix}events` WHERE `id` = {$event_edit_id}" );