TI-2021-06840 CVE-2021-24555 · GHSA-7qqw-3436-pv6f
Diary & Availability Calendar <= 1.0.3 - Authenticated (subscriber+) SQL Injection
Priority MEDIUM 40
The daac_delete_booking_callback function, hooked to the daac_delete_booking AJAX action, takes the id POST parameter which is passed into the SQL statement without proper sanitisation, validation or escaping, leading to…