What is CVE-2021-42077?

CVE-2021-42077 is a critical-severity vulnerability in Kaysongroup PHP Event Calendar, classified under SQL Injection. CVSS score: 9.8/10. Published 2021-11-08.

How severe is CVE-2021-42077?

Critical severity. CVSS v3 base score is 9.8 out of 10.

SQL Injection in Kaysongroup PHP Event Calendar

CVE-2021-42077

PHP Event Calendar before 2021-09-03 allows SQL injection, as demonstrated by the /server/ajax/user_manager.php username parameter. This can be used to execute SQL statements directly on the database, allowing an adversary in some cases to completely compromise the database system. It can also be used to bypass the login form.

Vulnerability class: SQL Injection

EPSS: 0.024 (82.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Kaysongroup Php_event_calendar
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

References

cve@mitre.org (Exploit, VDB Entry, Third Party Advisory, x_refsource_MISC)
cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-42077?: CVE-2021-42077 is a critical-severity vulnerability in Kaysongroup PHP Event Calendar, classified under SQL Injection. CVSS score: 9.8/10. Published 2021-11-08.
How severe is CVE-2021-42077?: Critical severity. CVSS v3 base score is 9.8 out of 10.