WordPress Events Registration with PayPal IPN Component Multiple SQL Injection Vulnerabilities

Bugtraq ID:	38546
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 04 2010 12:00AM
Updated:	Mar 04 2010 12:00AM
Credit:	sethshoultes
Vulnerable:	WordPress Events Registration with PayPal IPN 2.1.2
Not Vulnerable:	WordPress Events Registration with PayPal IPN 2.1.3

WordPress Events Registration with PayPal IPN Component Multiple SQL Injection Vulnerabilities

Events Registration with PayPal IPN plugin for WordPress is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to Events-Registration-with-PayPal-IPN 2.1.3 are vulnerable.

WordPress Events Registration with PayPal IPN Component Multiple SQL Injection Vulnerabilities

An attacker can exploit these issues via a browser.

WordPress Events Registration with PayPal IPN Component Multiple SQL Injection Vulnerabilities

Solution:
Updates are available to address this issue. Please see the references for more information.

WordPress Events Registration with PayPal IPN Component Multiple SQL Injection Vulnerabilities

References:

• Wordpress Events Registration with PayPal IPN Homepage (Smart Website Solutions)
  
• Changeset 198395 (Wordpress)