« Volver al listado

CVE-2017-1002018

Estado: ModificadaCrítica (9.8)—

Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and attendees.php code do not sanitize input, this allows for blind SQL injection via the event parameter.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Eventr Project — Eventr

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-1002018",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "larry0@me.com",
      "affectedData": [
        {
          "vendor": "Binny V A",
          "product": "eventr",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "1.02.2",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-09-14T13:29:00.857",
  "references": [
    {
      "url": "http://www.vapidlabs.com/advisory.php?v=192",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "larry0@me.com"
    },
    {
      "url": "https://wordpress.org/plugins/eventr/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "larry0@me.com"
    },
    {
      "url": "http://www.vapidlabs.com/advisory.php?v=192",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wordpress.org/plugins/eventr/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and attendees.php code do not sanitize input, this allows for blind SQL injection via the event parameter."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad en el plugin eventr v1.02.2 de WordPress. Ni el formulario en edit.php ni el código en attendees.php sanitizan los valores de entrada, lo que permite que se produzca una inyección SQL a ciegas mediante el parámetro event."
    }
  ],
  "lastModified": "2026-06-17T00:59:21.030",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:eventr_project:eventr:1.02.2:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C7ABD027-CA0A-49DE-892F-41C7680D317E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "larry0@me.com"
}