CVE-2021-24946: Modern Events Calendar Lite SQLi Flaw

CVE-2021-24946 Overview

CVE-2021-24946 is a critical SQL Injection vulnerability affecting the Modern Events Calendar Lite WordPress plugin. The plugin fails to properly sanitize and escape the time parameter before incorporating it into a SQL statement within the mec_load_single_page AJAX action. This endpoint is accessible to unauthenticated users, enabling attackers to execute arbitrary SQL queries against the WordPress database without any authentication.

Critical Impact

Unauthenticated attackers can extract sensitive data from the WordPress database, including user credentials, administrative information, and potentially gain complete control over the affected WordPress installation.

Affected Products

• Webnus Modern Events Calendar Lite versions prior to 6.1.5
• WordPress installations using vulnerable versions of the plugin
• Sites with default AJAX handler configurations

Discovery Timeline

• 2021-12-13 - CVE-2021-24946 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-24946

Vulnerability Analysis

This SQL Injection vulnerability exists within the mec_load_single_page AJAX action handler of the Modern Events Calendar Lite plugin. The vulnerability is particularly dangerous because it is exposed through WordPress's AJAX interface (/wp-admin/admin-ajax.php) which is accessible without authentication. The time parameter is passed directly into a SQL query without proper sanitization, allowing attackers to inject malicious SQL code that will be executed by the database.

The attack surface is significant as WordPress AJAX handlers are commonly exposed and the vulnerable endpoint requires no privileges to access. An attacker can craft malicious requests to extract database contents, modify data, or potentially escalate to remote code execution depending on database configuration and privileges.

Root Cause

The root cause of this vulnerability is improper input validation and lack of parameterized queries. The plugin's code directly concatenates user-supplied input (the time parameter) into SQL statements without using WordPress's prepared statement functions like $wpdb->prepare(). This violation of secure coding practices allows the injection of arbitrary SQL syntax that the database engine interprets as legitimate commands.

Attack Vector

The attack is executed over the network by sending specially crafted HTTP POST requests to the WordPress AJAX endpoint. Attackers target the mec_load_single_page action with a malicious payload in the time parameter. Since no authentication is required, any remote attacker can exploit this vulnerability. Successful exploitation can lead to:

• Complete database content extraction (usernames, password hashes, emails)
• Modification or deletion of database records
• Potential privilege escalation to administrative access
• In some configurations, potential for file system access or code execution

The vulnerability can be exploited using standard SQL injection techniques including time-based blind injection and UNION-based injection methods. Technical details and proof-of-concept exploits are available through the Packet Storm Security Advisory and GitHub Exploit Repository.

Detection Methods for CVE-2021-24946

Indicators of Compromise

• Unusual POST requests to /wp-admin/admin-ajax.php with action=mec_load_single_page
• SQL injection patterns in the time parameter including characters like single quotes, UNION statements, or time-delay functions
• Database error messages in logs indicating malformed SQL queries
• Unexpected database queries with long execution times (indicative of time-based blind SQL injection)

Detection Strategies

• Monitor web server access logs for requests to the AJAX endpoint containing SQL injection signatures
• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns targeting the time parameter
• Enable WordPress debug logging to capture database query errors that may indicate exploitation attempts
• Deploy intrusion detection systems (IDS) with signatures for common SQL injection payloads

Monitoring Recommendations

• Set up alerts for high-frequency requests to admin-ajax.php with the mec_load_single_page action
• Monitor database query logs for anomalous queries originating from the web application
• Review authentication logs for any new administrator accounts created unexpectedly
• Implement file integrity monitoring on WordPress core files and plugin directories

How to Mitigate CVE-2021-24946

Immediate Actions Required

• Update the Modern Events Calendar Lite plugin to version 6.1.5 or later immediately
• Audit database access logs for signs of exploitation prior to patching
• Review WordPress user accounts for unauthorized additions or privilege changes
• Consider temporarily disabling the plugin if immediate update is not possible

Patch Information

The vulnerability has been addressed in Modern Events Calendar Lite version 6.1.5. Site administrators should update to this version or later through the WordPress plugin update interface or by downloading directly from the WordPress plugin repository. For detailed vulnerability information, refer to the WPScan Vulnerability Report.

Workarounds

• Implement WAF rules to block requests containing SQL injection patterns in the time parameter
• Restrict access to admin-ajax.php at the web server level using IP allowlisting if feasible
• Disable the mec_load_single_page AJAX handler if functionality is not required
• Use security plugins that provide virtual patching capabilities for known vulnerabilities

# Apache .htaccess rule to restrict AJAX access (use with caution)
<Files "admin-ajax.php">
    <IfModule mod_rewrite.c>
        RewriteEngine On
        RewriteCond %{REQUEST_METHOD} POST
        RewriteCond %{QUERY_STRING} action=mec_load_single_page [NC,OR]
        RewriteCond %{REQUEST_BODY} action=mec_load_single_page [NC]
        RewriteRule ^ - [F,L]
    </IfModule>
</Files>