PT-2021-16073 · WordPress · Timeline Calendar Wordpress Plugin

Shreya Pohekar · Published 2021-08-23 · Updated 2021-08-26 · CVE-2021-24553

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Timeline Calendar WordPress plugin versions 1.2 and earlier

Description The issue is related to an authenticated SQL injection problem. It occurs because the edit GET parameter is not properly sanitised, validated, or escaped before being used in a SQL statement when editing events. Additionally, other SQL injection issues are present in the plugin.

Recommendations For Timeline Calendar WordPress plugin versions 1.2 and earlier, consider disabling the editing functionality for events until a patch is available to prevent exploitation of the SQL injection issue. Restrict access to the plugin's event editing feature to minimize the risk of authenticated SQL injection attacks. Avoid using the edit parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24553

Affected Products

Timeline Calendar Wordpress Plugin

References · 5

• 🔥 https://wpscan.com/vulnerability/14c75a00-a52b-430b-92da-5145e5aee30a · Exploit
• 🔥 https://codevigilant.com/disclosure/2021/wp-plugin-timeline-calendar · Exploit
• https://osv.dev/vulnerability/CVE-2021-24553 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24553 · Security Note
• https://t.me/cvenotify/20203 · Telegram Post