关键漏洞信息 漏洞标题 Registrations for the Events Calendar < 2.7.6 - Unauthenticated SQL Injection 描述 The plugin does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL injection. 影响的插件 registrations-for-the-events-calendar: Fixed in 2.7.6 参考 CVE: CVE-2021-24943 分类 Type: SQLI OWASP Top 10: A1: Injection CWE: CWE-89 CVSS: 8.6 (high) 其他信息 Original Researcher: Krzysztof Zając Submitter Website: https://kazet.cc/ Verified: Yes WPVDB ID: ba50c590-42ee-4523-8aa0-87ac644b77ed 时间线 Publicly Published: 2021-11-08 Added: 2021-11-08 Last Updated: 2022-04-12