.. / CVE-2015-2196

• SQLi
• Nuclei
• Web

Exploit for WordPress Spider Calendar <=1.4.9 - SQL Injection (CVE-2015-2196)

Description:

WordPress Spider Calendar plugin through 1.4.9 is susceptible to SQL injection. An attacker can execute arbitrary SQL commands via the cat_id parameter in a spiderbigcalendar_month action to wp-admin/admin-ajax.php, thus making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations.

Nuclei Template

View the template here CVE-2015-2196.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2015/CVE-2015-2196.yaml

References: