CVE-2015-2196 Scanner

Spider Event Calendar is a WordPress plugin designed to help website owners manage and display events seamlessly. It allows users to create, categorize, and schedule events, integrating them via shortcodes and widgets. Commonly used by event organizers, bloggers, and businesses, it simplifies event management on WordPress sites. However, its popularity also makes it a target for attackers seeking to exploit vulnerabilities.

CVE-2015-2196 is a critical SQL injection vulnerability found in Spider Event Calendar version 1.4.9. This flaw arises due to insufficient sanitization of user-supplied input passed to the cat_id parameter. Attackers can inject malicious SQL queries by manipulating this parameter, bypassing authentication and gaining unauthorized access to the database.

The vulnerability is triggered through the spiderbigcalendar_month action in the wp-admin/admin-ajax.php endpoint. Specifically, the cat_id parameter is directly concatenated into SQL queries without proper validation or escaping. This allows an attacker to craft a request with malicious SQL code, such as UNION-based injections, to extract sensitive data from the database.

If exploited, this vulnerability can lead to severe consequences, including unauthorized access to user credentials, personal data, and even full database compromise. Attackers can steal sensitive information like usernames, passwords, and payment details, install backdoors, or launch further attacks. The CVSS score of 7.5 highlights its high severity, making immediate remediation critical.