by Kastro
Paper/Archive/CVE-2021-42077

CVE-2021-42077

mitre — PHP Event Calendar before 2021-09-03 allows SQL injection, as demonstrated by the /server/ajax/user_manager.php username parameter.

EPSS 3%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 84.8.848 × 2017.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

PHP Event Calendar before 2021-09-03 allows SQL injection, as demonstrated by the /server/ajax/user_manager.php username parameter. This can be used to execute SQL statements directly on the database, allowing an adversary in some cases to completely compromise the database system. It can also be used to bypass the login form.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refpacketstormsecurity.com/files/164777/PHP-Event-Calendar-Lite-Edition-SQL-Injection.htmlrefsyss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-048.txt