Stiofan Events Calendar for GeoDirectory PHP Object Injection Vulnerability

A deserialization vulnerability allowing object injection has been identified in the Stiofan Events Calendar for GeoDirectory, affecting versions through 2.3.14. This vulnerability arises from the deserialization of untrusted data, which could lead to PHP object injection, potentially allowing a malicious actor to execute code injection, SQL injection, path traversal, denial of service, and more, if a suitable property-oriented programming chain is available.

Impact

Exploitation of this vulnerability could result in PHP object injection, allowing for various types of code injection, SQL injection, path traversal, denial of service, and more, depending on the presence of a proper property-oriented programming chain.

Remediation

Users are advised to update to version 2.3.15 or later. Patchstack users can enable auto-update for vulnerable plugins.