A SQL injection vulnerability in the Redaxo CMS MyEvents addon (version 2.2.1) presents a security risk, requiring authenticated access for successful exploitation.

This vulnerability is an Improper Neutralization of Special Elements used in an SQL Command (CWE-89). It requires the attacker to have low-level privileges (authenticated) to successfully inject malicious SQL queries into the database via the vulnerable component.

The ability to perform SQL injection allows an attacker to interact directly with the application’s backend database. This could lead to unauthorized data exfiltration, modification of sensitive records, or potential bypass of authentication mechanisms, resulting in significant loss of data integrity and confidentiality. While the CVSS score of 7.1 reflects high severity, the requirement for authenticated access slightly lowers the immediate risk compared to unauthenticated remote execution.

Immediate Action: Since a specific patch version is not currently identified in the enrichment data, administrators should audit the addon's source code for unsanitized input or contact the vendor for a security update. If no update is available, consider disabling the MyEvents addon.

Proactive Monitoring: Monitor database query logs for unusual syntax, such as UNION SELECT statements or excessive error messages originating from the web application's database service.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block common SQL injection patterns targeting the MyEvents addon endpoints.

Public Exploit Available: Yes — an entry exists on ExploitDB.

Given the availability of a public exploit, administrators must treat this vulnerability with urgency. If the MyEvents addon is not mission-critical, it should be disabled immediately until a secure version is provided by the developer. Ensure that all database interactions are reviewed for proper parameterization to prevent similar injection vectors.