CVE-2017-1002023 - Vulnerability in wordpress plugin Easy Team Manager v1.3.2, The code does not sanitize id before making it part of an SQL statement in file ./easy-team-manager/inc/easy_team_manager_desc_edit.php

Back Back to CVE browser

CRITICAL

Vulnerability in wordpress plugin Easy Team Manager v1.3.2, The code does not sanitize id before making it part of an SQL statement in file ./easy-team-manager/inc/easy_team_manager_desc_edit.php

Published Sep 14, 2017

9.8

CRITICAL

CVSS 3.0

EPSS 2.96%

Description

Vulnerability in wordpress plugin Easy Team Manager v1.3.2, The code does not sanitize id before making it part of an SQL statement in file ./easy-team-manager/inc/easy_team_manager_desc_edit.php

Affected products

Vendor Daisy Themes Product Easy Team Manager Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <1.3.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Daisy Themes

Easy Team Manager

n/a

Version	Status	Constraints
unspecified	affected	<1.3.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (3)

http://www.vapidlabs.com/advisory.php?v=194
x_refsource_MISCExploitPatchThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-1638
Advisory
https://wordpress.org/plugins/easy-team-manager/
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
http://www.vapidlabs.com/advisory.php?v=194		x_refsource_MISCExploitPatchThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-1638		Advisory
https://wordpress.org/plugins/easy-team-manager/		x_refsource_MISCThird Party Advisory