Unauthenticated SQL Injection in The Events Calendar Custom Tables Query

The Events Calendar up to and including 6.15.1 redirects the ORDER BY clause of event queries through Custom_Tables_Query::parse_orderby(), but falls back to the raw, unvalidated ORDER BY fragment whenever the field is not recognised. An unauthenticated visitor can therefore smuggle arbitrary SQL into the ORDER BY clause of a public events query... Weiterlesen