NVD Vulnerability Detail

CVE-2013-10023

Summary	A vulnerability was found in Editorial Calendar Plugin up to 2.6 on WordPress. It has been declared as critical. Affected by this vulnerability is the function edcal_filter_where of the file edcal.php. The manipulation of the argument edcal_startDate/edcal_endDate leads to sql injection. The attack can be launched remotely. Upgrading to version 2.7 is able to address this issue. The patch is named a9277f13781187daee760b4dfd052b1b68e101cc. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-225151.
Publication Date	April 8, 2023, 6:15 p.m.
Registration Date	April 8, 2023, 8 p.m.
Last Update	Nov. 21, 2024, 10:48 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:editorial_calendar_project:editorial_calendar::::::wordpress::*					2.7

Related information, measures and tools

No	URL	タグ
1	https://github.com/wp-plugins/editorial-calendar/commit/a9277f13781187daee760b4dfd052b1b68e101cc	Patch
2	https://github.com/wp-plugins/editorial-calendar/commit/a9277f13781187daee760b4dfd052b1b68e101cc	Patch
3	https://github.com/wp-plugins/editorial-calendar/releases/tag/2.7	Release Notes
4	https://github.com/wp-plugins/editorial-calendar/releases/tag/2.7	Release Notes
5	https://vuldb.com/?ctiid.225151	Third Party Advisory
6	https://vuldb.com/?ctiid.225151	Third Party Advisory
7	https://vuldb.com/?id.225151	Third Party Advisory
8	https://vuldb.com/?id.225151	Third Party Advisory

Common Vulnerabilities List

JVN Vulnerability Information

editorial calendar project の WordPress 用 editorial calendar における SQL インジェクションの脆弱性

Title	editorial calendar project の WordPress 用 editorial calendar における SQL インジェクションの脆弱性
Summary	editorial calendar project の WordPress 用 editorial calendar には、SQL インジェクションの脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダアドバイザリまたはパッチ情報が公開されています。参考情報を参照して適切な対策を実施してください。
Publication Date	April 8, 2023, midnight
Registration Date	Nov. 17, 2023, 1:35 p.m.
Last Update	Nov. 17, 2023, 1:35 p.m.

Affected System

editorial calendar project

editorial calendar 2.7 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2013-10023	https://www.cve.org/CVERecord?id=CVE-2013-10023
National Vulnerability Database (NVD)
2	CVE-2013-10023	https://nvd.nist.gov/vuln/detail/CVE-2013-10023

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-89	https://jvndb.jvn.jp/ja/cwe/CWE-89.html

その他

No	Name	URL
関連文書
1	github.com (a9277f13781187daee760b4dfd052b1b68e101cc)	https://github.com/wp-plugins/editorial-calendar/commit/a9277f13781187daee760b4dfd052b1b68e101cc
2	github.com (tag/2.7)	https://github.com/wp-plugins/editorial-calendar/releases/tag/2.7
3	vuldb.com (ctiid.225151)	https://vuldb.com/?ctiid.225151
4	vuldb.com (id.225151)	https://vuldb.com/?id.225151

Change Log

No	Changed Details	Date of change
1	[2023年11月17日] 掲載	Nov. 17, 2023, 1:35 p.m.