{"id": "CVE-2005-4011", "bulletinFamily": "NVD", "title": "CVE-2005-4011", "description": "SQL injection vulnerability in calendar.php in Codewalkers ltwCalendar (aka PHP Event Calendar) 4.2, 4.1.3, and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.", "published": "2005-12-05T11:03:00", "modified": "2018-10-19T15:39:00", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-4011", "reporter": "cve@mitre.org", "references": ["https://exchange.xforce.ibmcloud.com/vulnerabilities/27362", "http://pridels0.blogspot.com/2005/11/codewalkers-ltwcalendar-4x-sql-inj.html", "http://ltwcalendar.sourceforge.net/changelog.php", "http://securitytracker.com/id?1016364", "http://www.securityfocus.com/bid/18593", "http://www.attrition.org/pipermail/vim/2006-December/001154.html", "http://www.securityfocus.com/archive/1/438580/100/0/threaded", "https://exchange.xforce.ibmcloud.com/vulnerabilities/23312", "http://www.osvdb.org/27539", "http://www.vupen.com/english/advisories/2005/2652", "http://www.securityfocus.com/bid/15636", "http://secunia.com/advisories/17799", "http://www.securityfocus.com/archive/1/438232/100/0/threaded", "http://www.osvdb.org/21195", "http://www.Silitix.com/calendar-cws.php"], "cvelist": ["CVE-2005-4011"], "type": "cve", "lastseen": "2019-05-29T18:08:15", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "abb8b77cb9374b088634133f2051c198"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cpe23", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvelist", "hash": "723994273b1492b9f25a1241eeac4077"}, {"key": "cvss", "hash": "0b053db5674b87efff89989a8a720df3"}, {"key": "cvss2", "hash": "7f7c77d2dde7216a66d00321bd5828f8"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cwe", "hash": "4994f73f97fee1825d38aac7bee9aefe"}, {"key": "description", "hash": "b3f4c0dea9ddcbe807caeceb0cab9fc7"}, {"key": "href", "hash": "6542d907cc841fd1901c06890638ca17"}, {"key": "modified", "hash": "1bb3ccf195670eb54ad8d079a40ad4ef"}, {"key": "published", "hash": "9c9f8d1d65420b76e8b8b3f6a589c46a"}, {"key": "references", "hash": "44a5863918a7ac2c73056b0479692344"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "fc3078f182fc8a82032cecf4def779a6"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "b282530d617192ac15c0ff96c7806adef6b36b06736eef77990c2005c198770e", "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "osvdb", "idList": ["OSVDB:21195", "OSVDB:27539"]}, {"type": "exploitdb", "idList": ["EDB-ID:28088"]}], "modified": "2019-05-29T18:08:15"}, "score": {"value": 7.6, "vector": "NONE", "modified": "2019-05-29T18:08:15"}, "vulnersScore": 7.6}, "objectVersion": "1.3", "cpe": [], "affectedSoftware": [{"name": "codewalkers ltwcalendar", "operator": "le", "version": "4.1.3"}], "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {}, "cpe23": [], "cwe": ["CWE-89"]}

{"osvdb": [{"lastseen": "2017-04-28T13:20:18", "bulletinFamily": "software", "description": "## Vulnerability Description\nItwCalendar contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the calendar.php script not properly sanitizing user-supplied input to the 'id' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n## Solution Description\nUpgrade to version 4.2.1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## Short Description\nItwCalendar contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the calendar.php script not properly sanitizing user-supplied input to the 'id' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n## Manual Testing Notes\n/calendar.php?display=event&id=[SQL]\n## References:\nVendor URL: http://calendar.codewalkers.com/\nVendor Specific News/Changelog Entry: http://ltwcalendar.sourceforge.net/changelog.php\n[Secunia Advisory ID:17799](https://secuniaresearch.flexerasoftware.com/advisories/17799/)\nOther Advisory URL: http://pridels.blogspot.com/2005/11/codewalkers-ltwcalendar-4x-sql-inj.html\nMail List Post: http://attrition.org/pipermail/vim/2006-December/001154.html\nISS X-Force ID: 23312\n[CVE-2005-4011](https://vulners.com/cve/CVE-2005-4011)\n", "modified": "2005-11-29T10:19:48", "published": "2005-11-29T10:19:48", "href": "https://vulners.com/osvdb/OSVDB:21195", "id": "OSVDB:21195", "title": "ltwCalendar calendar.php id Variable SQL Injection", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:24", "bulletinFamily": "software", "description": "## Vulnerability Description\nPHP Event Calendar contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'calendar.php' script not properly sanitizing user-supplied input to the 'id' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n## Solution Description\nUpgrade to version 4.2.1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## Short Description\nPHP Event Calendar contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'calendar.php' script not properly sanitizing user-supplied input to the 'id' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n## Manual Testing Notes\n/calendar.php?display=event&id=[SQL]\n## References:\nVendor URL: http://calendar.codewalkers.com/\nSecurity Tracker: 1016364\n[Secunia Advisory ID:17799](https://secuniaresearch.flexerasoftware.com/advisories/17799/)\nOther Advisory URL: http://pridels.blogspot.com/2005...kers-ltwcalendar-4x-sql-inj.html\nOther Advisory URL: http://www.Silitix.com/calendar-cws.php\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-06/0503.html\nKeyword: ltwCalendar\nISS X-Force ID: 27362\nISS X-Force ID: 23312\n[CVE-2006-3248](https://vulners.com/cve/CVE-2006-3248)\n[CVE-2005-4011](https://vulners.com/cve/CVE-2005-4011)\nBugtraq ID: 18593\n", "modified": "2005-11-29T00:00:00", "published": "2005-11-29T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:27539", "id": "OSVDB:27539", "title": "Codewalkers PHP Event Calendar calendar.php id Variable SQL Injection", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "exploitdb": [{"lastseen": "2016-02-03T07:24:00", "bulletinFamily": "exploit", "description": "PHP Event Calendar 4.2 SQL Injection Vulnerability. CVE-2005-4011. Webapps exploit for php platform", "modified": "2006-06-22T00:00:00", "published": "2006-06-22T00:00:00", "id": "EDB-ID:28088", "href": "https://www.exploit-db.com/exploits/28088/", "type": "exploitdb", "title": "PHP Event Calendar 4.2 - SQL Injection Vulnerability", "sourceData": "source: http://www.securityfocus.com/bid/18593/info\r\n\r\nPHP Event Calendar is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.\r\n\r\nA successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.\r\n\r\nhttp://www.example.com/calendar.php?display=event&id=[SQL]", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/28088/"}]}