CVEvulnerability
CVE-2021-42077
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2021-11-08
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-89
Description
PHP Event Calendar before 2021-09-03 allows SQL injection, as demonstrated by the /server/ajax/user_manager.php username parameter. This can be used to execute SQL statements directly on the database, allowing an adversary in some cases to completely compromise the database system. It can also be used to bypass the login form.
Affected configurations
• kaysongroup php event calendar (< 2021-09-03)
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://packetstormsecurity.com/files/164777/PHP-Event-Calendar-Lite-Edition-SQL-Injection.html Exploit, Third Party Advisory, VDB Entry
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-048.txt Exploit, Third Party Advisory
- http://packetstormsecurity.com/files/164777/PHP-Event-Calendar-Lite-Edition-SQL-Injection.html Exploit, Third Party Advisory, VDB Entry
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-048.txt Exploit, Third Party Advisory