CVE-2018-6367

Name of the Vulnerable Software and Affected Versions Vastal I-Tech Buddy Zone Facebook Clone version 2.9.9

Description A SQL Injection issue exists, allowing potential exploitation through specific parameters in certain API endpoints. The issue can be exploited via the "request id" parameter in the "/chat im/chat window.php" endpoint or the "category" parameter in the "/search events.php" endpoint.

Recommendations For version 2.9.9, consider restricting access to the "/chat im/chat window.php" and "/search events.php" endpoints until a fix is available, and avoid using the request id and category parameters in these endpoints to minimize the risk of exploitation.