Recent
Categories
Tags
You need to be logged in to view a user's profile.
View Replies (1)

Resolved SQL Injection attack - High Vulnerability found in RSVP Pro

  1. Issue
0
Votes
Undo
  1. intellitech
    intellitech
    Gold Member
  2. JEvents 3.4 (Free Access)
  3. Monday, 27 September 2021
We did a website (scl.org.sg) scan & the result showed 1 high risk vulnerability in SQL Injection scan.

Scan report attached. Please do the needful ASAP.
Attachments (1)
20210925_SQL_Affected_Items_www_scl_org_sg (2).pdf
Popup not working on first event
Problems with JEvents - Latest Events Module
Responses (1)
tonyp
tonyp
Support Team
Accepted Answer Pending Moderation
0
Votes
Undo
Hello,

This is more of a false positive. They are changing the filter value from ASC / DESC to a word that doesn't exist in the order by clause hence the failover. If they tried to execute SQL any SQL Injection would be filtered within it.

I'll make a change to ensure this filter only accepts ASC/DESC however in future versions.

Many thanks
Tony
JEvents Club members can get priority forum support at the Support Forum. As well as access to a variety of custom JEvents addons and benefits. Join the JEvents club today!Join the JEvents club today!
  1. more than a month ago
  2. JEvents 3.4 (Free Access)
  3. # 1
  • Page :
  • 1


There are no replies made for this post yet.
Be one of the first to reply to this post!