high7.5Public exploit code
CVE-2015-7235
Multiple SQL injection vulnerabilities in dex_reservations.php in the CP Reservation Calendar plugin before 1.1.7 for WordPress allow remote attackers to execu…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WordPress Plugin CP Reservation Calendar 1.1.6 - SQL Injection2015-09-15 · webapps · php
Impact
Multiple SQL injection vulnerabilities in dex_reservations.php in the CP Reservation Calendar plugin before 1.1.7 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in a dex_reservations_calendar_load2 action or (2) dex_item parameter in a dex_reservations_check_posted_data action in a request to the default URI.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cp Reservation Calender Project | Cp Reservation Calender | through 1.1.6 |
Weakness classification
References
- NVD record
- CVE.org record
- https://plugins.trac.wordpress.org/changeset/1104099/cp-reservation-calendar
- https://wordpress.org/plugins/cp-reservation-calendar/changelog/
- https://wpvulndb.com/vulnerabilities/8193
- https://www.exploit-db.com/exploits/38187/
- https://plugins.trac.wordpress.org/changeset/1104099/cp-reservation-calendar
- https://wordpress.org/plugins/cp-reservation-calendar/changelog/
- https://wpvulndb.com/vulnerabilities/8193
- https://www.exploit-db.com/exploits/38187/