ASP Inline Corporate Calendar details.asp Event_ID SQL Injection

2005-05-03T07:56:55
ID OSVDB:16193
Type osvdb
Reporter Zinho(zinho@hackerscenter.com)
Modified 2005-05-03T07:56:55

Description

Vulnerability Description

ASP Inline Corporate Calendar contains a flaw that may allow an attacker to inject arbitrary SQL queries. The issue is due to the 'Event_ID' variable in the details.asp script not being properly sanitized and may allow an attacker to inject or manipulate SQL queries.

Solution Description

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Short Description

ASP Inline Corporate Calendar contains a flaw that may allow an attacker to inject arbitrary SQL queries. The issue is due to the 'Event_ID' variable in the details.asp script not being properly sanitized and may allow an attacker to inject or manipulate SQL queries.

References:

Vendor URL: http://www.aaronoutpost.com/ASP/Programs/Calendar.asp Security Tracker: 1013884 Secunia Advisory ID:15239 Related OSVDB ID: 16192 Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2005-05/0030.html