CyberSec.Space Logo
CVEブラウザに戻る

CVE-2021-42077

CRITICAL
9.8
CVSS Severity Score
EPSS Score0.0180%
EPSS Percentile16.26th
Published2021年11月8日
Last Modified2024年11月21日

Vulnerability Description

PHP Event Calendar before 2021-09-03 allows SQL injection, as demonstrated by the /server/ajax/user_manager.php username parameter. This can be used to execute SQL statements directly on the database, allowing an adversary in some cases to completely compromise the database system. It can also be used to bypass the login form.

Affected Platforms (CPE)

📦
Kaysongroup

Php Event Calendar

< 2021-09-03

References & Advisories

🔗 http://packetstormsecurity.com/files/164777/PHP-Event-Calendar-Lite-Edition-SQL-Injection.html
🔗 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-048.txt
🔗 http://packetstormsecurity.com/files/164777/PHP-Event-Calendar-Lite-Edition-SQL-Injection.html
🔗 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-048.txt

関連する脆弱性情報

CVE-2008-467310.0

PHP remote file inclusion vulnerability in panel/common/theme/default/header_setup.php in WebBiscuits Software Events Calendar 1.1...

CVE-2026-395328.8

Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions.

CVE-2005-40117.5

SQL injection vulnerability in calendar.php in Codewalkers ltwCalendar (aka PHP Event Calendar) 4.2, 4.1.3, and earlier allows rem...

CVE-2004-15307.5

SQL injection vulnerability in the Event Calendar module 2.13 for PHP-Nuke allows remote attackers to execute arbitrary SQL comman...