This host is running WordPress Spider Calendar Plugin and is prone to multiple SQL Injection vulnerabilities.

Successful exploitation could allow attackers to manipulate SQL queries by injecting arbitrary SQL code and gain sensitive information. Impact Level: Application

Upgrade to WordPress Spider Calendar Plugin version 1.1.0 or later, For updates refer to http://wordpress.org/extend/plugins/spider-calendar/

Input passed via the 'calendar_id' parameter to 'front_end/spidercalendarbig_seemore.php' (when 'ev_ids' is set to the id of an available event) is not properly sanitised before being used in a SQL query.

WordPress Spider Calendar Plugin version 1.0.1

• http://packetstormsecurity.org/files/117078/WordPress-Spider-1.0.1-SQL-Injection-XSS.html
• http://secunia.com/advisories/50812
• http://www.exploit-db.com/exploits/21715/
• http://xforce.iss.net/xforce/xfdb/79042

---

Updated on 2015-03-25