PT-2021-16072 · WordPress · Simple Events Calendar

Shreya Pohekar · Published 2021-08-23 · Updated 2021-08-26 · CVE-2021-24552

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Simple Events Calendar WordPress plugin versions prior to 1.4.1

Description The issue arises from the lack of sanitization, validation, or escaping of the event id POST parameter before its use in a SQL statement when deleting events. This leads to an authenticated SQL injection issue.

Recommendations For versions prior to 1.4.1, update to version 1.4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the event deletion functionality until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24552

Affected Products

Simple Events Calendar

References · 5

• 🔥 https://wpscan.com/vulnerability/3482a015-a5ed-4913-b516-9eae2b3f89db · Exploit
• 🔥 https://codevigilant.com/disclosure/2021/wp-plugin-simple-events-calendar · Exploit
• https://osv.dev/vulnerability/CVE-2021-24552 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24552 · Security Note
• https://t.me/cvenotify/20204 · Telegram Post