CVE-2021-42077

Опубликовано: 08 нояб. 2021

Источник: nvd

CVSS3: 9.8

CVSS2: 10

EPSS Низкий

Описание

PHP Event Calendar before 2021-09-03 allows SQL injection, as demonstrated by the /server/ajax/user_manager.php username parameter. This can be used to execute SQL statements directly on the database, allowing an adversary in some cases to completely compromise the database system. It can also be used to bypass the login form.

Ссылки

http://packetstormsecurity.com/files/164777/PHP-Event-Calendar-Lite-Edition-SQL-Injection.html
Exploit
Third Party Advisory
VDB Entry
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-048.txt
Exploit
Third Party Advisory
http://packetstormsecurity.com/files/164777/PHP-Event-Calendar-Lite-Edition-SQL-Injection.html
Exploit
Third Party Advisory
VDB Entry
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-048.txt
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:kaysongroup:php_event_calendar:*:*:*:*:lite:*:*:*

Версия до 2021-09-03 (исключая)

EPSS

Процентиль: 73%

0.00754

Низкий

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-7jgw-jw8c-v49c

github

больше 3 лет назад