Unauthenticated SQL Injection in The Events Calendar Custom Tables Query

The Events Calendar up to and including 6.15.1 redirects the ORDER BY clause of event queries through Custom_Tables_Query::parse_orderby(), but falls back to the raw, unvalidated ORDER BY fragment whenever the field is not recognised. An unauthenticated visitor can therefore smuggle arbitrary SQL into the ORDER BY clause of a public events query (reachable via the search parameter) and extract database contents through a time-based blind injection.

This vulnerability affects the following application versions:

• The Events Calendar 6.0.4
• The Events Calendar 6.0.5
• The Events Calendar 6.0.6
• The Events Calendar 6.0.6.1
• The Events Calendar 6.0.6.2
• The Events Calendar 6.0.7
• The Events Calendar 6.0.7.1
• The Events Calendar 6.0.8
• The Events Calendar 6.0.9
• The Events Calendar 6.0.10
• The Events Calendar 6.0.11
• The Events Calendar 6.0.12
• The Events Calendar 6.0.13
• The Events Calendar 6.0.13.1
• The Events Calendar 6.1.0
• The Events Calendar 6.1.0.1
• The Events Calendar 6.1.0.2
• The Events Calendar 6.1.1
• The Events Calendar 6.1.2
• The Events Calendar 6.1.2.1
• The Events Calendar 6.1.2.2
• The Events Calendar 6.1.3
• The Events Calendar 6.1.4
• The Events Calendar 6.2.0
• The Events Calendar 6.2.0.1
• The Events Calendar 6.2.1
• The Events Calendar 6.2.2
• The Events Calendar 6.2.2.1
• The Events Calendar 6.2.3
• The Events Calendar 6.2.3.1
• The Events Calendar 6.2.3.2
• The Events Calendar 6.2.4
• The Events Calendar 6.2.5
• The Events Calendar 6.2.6
• The Events Calendar 6.2.6.1
• The Events Calendar 6.2.7
• The Events Calendar 6.2.8
• The Events Calendar 6.2.8.1
• The Events Calendar 6.2.8.2
• The Events Calendar 6.3.0
• The Events Calendar 6.3.1
• The Events Calendar 6.3.3
• The Events Calendar 6.3.3.1
• The Events Calendar 6.3.4
• The Events Calendar 6.3.5
• The Events Calendar 6.3.6
• The Events Calendar 6.3.7
• The Events Calendar 6.4.0
• The Events Calendar 6.4.0.1
• The Events Calendar 6.5.0
• The Events Calendar 6.5.0.1
• The Events Calendar 6.5.1
• The Events Calendar 6.5.1.1
• The Events Calendar 6.5.1.2
• The Events Calendar 6.5.1.3
• The Events Calendar 6.5.1.4
• The Events Calendar 6.5.1.5
• The Events Calendar 6.5.1.6
• The Events Calendar 6.5.2
• The Events Calendar 6.6.0
• The Events Calendar 6.6.0.1
• The Events Calendar 6.6.0.2
• The Events Calendar 6.6.1
• The Events Calendar 6.6.2
• The Events Calendar 6.6.3
• The Events Calendar 6.6.4
• The Events Calendar 6.6.4.1
• The Events Calendar 6.6.4.2
• The Events Calendar 6.7.0
• The Events Calendar 6.7.1
• The Events Calendar 6.8.0
• The Events Calendar 6.8.1
• The Events Calendar 6.8.2
• The Events Calendar 6.8.2.1
• The Events Calendar 6.8.3
• The Events Calendar 6.9.0
• The Events Calendar 6.9.1
• The Events Calendar 6.10.0
• The Events Calendar 6.10.1
• The Events Calendar 6.10.1.1
• The Events Calendar 6.10.2
• The Events Calendar 6.10.3
• The Events Calendar 6.11.0.1
• The Events Calendar 6.11.1
• The Events Calendar 6.11.2
• The Events Calendar 6.11.2.1
• The Events Calendar 6.13.0
• The Events Calendar 6.13.1
• The Events Calendar 6.13.2.1
• The Events Calendar 6.14.0
• The Events Calendar 6.14.1
• The Events Calendar 6.14.2
• The Events Calendar 6.15.0
• The Events Calendar 6.15.0.1
• The Events Calendar 6.15.1