Executive brief
The MyEvents addon for Redaxo CMS, which is used to manage and display event schedules, contains a security flaw. An authorized user with access to the backend can manipulate database queries to view or change sensitive information they should not be able to access. This could lead to the theft of private data or unauthorized modification of website content.
Technical details
An SQL injection vulnerability exists in the MyEvents addon (version 2.2.1) for Redaxo CMS. The flaw is located in the 'event_add.php' component, where the 'myevents_id' parameter is insufficiently sanitized before being used in a database query. Although the code uses 'strip_tags', it fails to prevent SQL injection. An authenticated attacker with backend access can exploit this by sending a crafted GET request to 'redaxo/index.php?page=myevents/event_add'. Successful exploitation allows the attacker to extract sensitive data from the database or modify records. A public exploit (EDB-44261) has been available since 2018.
Affected products
- Redaxo CMS MyEvents Addon 2.2.1
Timeline
- 2018-03-01: disclosed: Vulnerability discovered by h0n1gsp3cht
- 2018-03-07: other: Exploit published on Exploit-DB (EDB-44261)
- 2026-05-17: advisory: CVE-2018-25319 published by NVD/VulnCheck