CVE-2021-24555: The daac_delete_booking_callback function, hooked to the daac_delete_booking AJAX action, takes the id POST parameter which is passed into the SQL statement without proper sanitisation, validation ...

Summary

The daac_delete_booking_callback function, hooked to the daac_delete_booking AJAX action, takes the id POST parameter which is passed into the SQL statement without proper sanitisation, validation or escaping, leading to a SQL Injection issue. Furthermore, the ajax action is lacking any CSRF and cap...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
roosty	diary-availability-calendar	<= 1.0.3 `cpe:2.3:a:roosty:diary-availability-calendar::::::wordpress::*`

Original advisory text

The daac_delete_booking_callback function, hooked to the daac_delete_booking AJAX action, takes the id POST parameter which is passed into the SQL statement without proper sanitisation, validation ...

The daac_delete_booking_callback function, hooked to the daac_delete_booking AJAX action, takes the id POST parameter which is passed into the SQL statement without proper sanitisation, validation or escaping, leading to a SQL Injection issue. Furthermore, the ajax action is lacking any CSRF and capability check, making it available to any authenticated user.

References

https://codevigilant.com/disclosure/2021/wp-plugin-diary-availability-calendar/ Exploit Third Party Advisory
https://wpscan.com/vulnerability/8eafd84b-6214-450b-869b-0afe7cca4c5f Exploit Third Party Advisory