CVE-2021-42077
CRITICAL 9.8EPSS 2.5%
PHP Event Calendar before 2021-09-03 allows SQL injection, as demonstrated by the /server/ajax/user_manager.php username parameter. This can be used to execute SQL statements directly on the database, allowing an adversary in some cases to completely compromise the database system. It can also be used to bypass the login form.
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0 NVD
- 10.0 HIGH
AV:N/AC:L/Au:N/C:C/I:C/A:C - EPSS
- 2.51% chance of exploitation in the next 30 days, 85th percentile
- Published
- 2021-11-08
- Updated
- 2024-08-04
Proof-of-concept exploits (2)
- http://packetstormsecurity.com/files/164777/PHP-Event-Calendar-Lite-Edition-SQL-Injection…
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-048.txt