CVE-2021-24555CWE-352CWE-89

Diary & Availability Calendar <= 1.0.3 - Authenticated (subscriber+) SQL Injection

published August 23, 2021

CVSS
—
EPSS
1%
Percentile
56.8
In the wild
Unconfirmed
What it is

The daac_delete_booking_callback function, hooked to the daac_delete_booking AJAX action, takes the id POST parameter which is passed into the SQL statement without proper sanitisation, validation or escaping, leading to a SQL Injection issue. Furthermore, the ajax action is lacking any CSRF and capability check, making it available to any authenticated user.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00821 · 56.8th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2021-08-23T11:10Z
EPSS history
Timeline
  • 23 AUG 11:10Z
    Diary & Availability Calendar <= 1.0.3 - Authenticated (subscriber+) SQL Injection
    cvelistv5