ASP Inline Corporate Calendar defer.asp Event_ID Variable SQL Injection

2005-05-03T07:56:55
ID OSVDB:16192
Type osvdb
Reporter Zinho(zinho@hackerscenter.com)
Modified 2005-05-03T07:56:55

Description

Vulnerability Description

ASP Inline Corporate Calendar contains a flaw that may allow an attacker to inject arbitrary SQL queries. The issue is due to the 'Event_ID' variable in the defer.asp script not being properly sanitized and may allow an attacker to inject or manipulate SQL queries.

Solution Description

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Short Description

ASP Inline Corporate Calendar contains a flaw that may allow an attacker to inject arbitrary SQL queries. The issue is due to the 'Event_ID' variable in the defer.asp script not being properly sanitized and may allow an attacker to inject or manipulate SQL queries.

References:

Vendor URL: http://www.aaronoutpost.com/ASP/Programs/Calendar.asp Security Tracker: 1013884 Secunia Advisory ID:15239 Related OSVDB ID: 16193 Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2005-05/0030.html