Calendarix 0.8.20080808 Cross Site Scripting / SQL Injection

============================= Vulnerability ID: HTB22974 Reference: http://www.htbridge.ch/advisory/multiplexssincalendarix.html Product: Calendarix Vendor: http://www.calendarix.com http://www.calendarix.com Vulnerable Version: 0.8.20080808 Vendor Notification: 26 April 2011 Vulnerability Type:...

HTB22974: Multiple XSS in Calendarix

Vulnerability ID: HTB22974 Reference: http://www.htbridge.ch/advisory/multiplexssincalendarix.html Product: Calendarix Vendor: http://www.calendarix.com http://www.calendarix.com Vulnerable Version: 0.8.20080808 Vendor Notification: 26 April 2011 Vulnerability Type: XSS Cross Site Scripting Risk...

HTB22975: SQL injection in Calendarix

Vulnerability ID: HTB22975 Reference: http://www.htbridge.ch/advisory/sqlinjectionincalendarix.html Product: Calendarix Vendor: http://www.calendarix.com http://www.calendarix.com Vulnerable Version: 0.8.20080808 Vendor Notification: 26 April 2011 Vulnerability Type: SQL Injection Risk level: Hig...

Calendarix 0.8.20080808 - Multiple Cross-Site Scripting / SQL Injections

source: https://www.securityfocus.com/bid/47790/info Calendarix is prone to multiple cross-site scripting vulnerabilities and an SQL-injection vulnerability because the application fails to sufficiently sanitize user-supplied input. Exploiting these issues could allow an attacker to steal...

Calendarix 0.8.20080808 - Multiple Cross-Site Scripting SQL Injections

Calendarix 0.8.20080808 - Multiple Cross-Site Scripting SQL Injections source: https://www.securityfocus.com/bid/47790/info Calendarix is prone to multiple cross-site scripting vulnerabilities and an SQL-injection vulnerability because the application fails to sufficiently sanitize user-supplied...

Cross-site Scripting (XSS) Vulnerabilities in Calendarix

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Calendarix which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerabilities in Calendarix 1.1 The vulnerability exists due to input sanitation errors in URL in...

Calendarix SQL Injection

=============================================================================== Calendarix calcat.php SQL Injection Vulnerability =============================================================================== Author : SixP4ck3r Email & msn : [email protected] Date : 17 July 2010 Critical Lvl...

Calendarix - cal_cat.php SQL Injection

Calendarix - calcat.php SQL Injection =============================================================================== Calendarix calcat.php SQL Injection Vulnerability =============================================================================== Author : SixP4ck3r Email & msn :...

Calendarix (cal_cat.php) SQL Injection Vulnerability

Exploit for php platform in category web applications ==================================================== Calendarix calcat.php SQL Injection Vulnerability ==================================================== Author : SixP4ck3r Email & msn : email protected Date : 17 July 2010 Critical Lvl : Hig...

Calendarix - 'cal_cat.php' SQL Injection

=============================================================================== Calendarix calcat.php SQL Injection Vulnerability =============================================================================== Author : SixP4ck3r Email & msn : [email protected] Date : 17 July 2010 Critical Lvl...

Calendarix 0.8.20071118 - SQL Injection

Calendarix 0.8.20071118 - SQL Injection Informatique inside Calendarix : SQL injection Version : 0.8.20071118 et infrieur Author : Thibow Contact : Thibow4tlinformatique-insidedotcom Location : France Website : http://www.informatique-inside.com Dork : "inurl:calday.php?op=day&catview=" Solution ...

Calendarix v0.8.20071118 SQL Injection

Exploit for unknown platform in category web applications ====================================== Calendarix v0.8.20071118 SQL Injection ====================================== Informatique inside Calendarix : SQL injection Version : 0.8.20071118 et http://vulnWebSite/calday.php?op=day&catview=-2...

Calendarix 0.7 - calpath Remote File Inclusion

Calendarix 0.7 - calpath Remote File Inclusion source: https://www.securityfocus.com/bid/37673/info Calendarix is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remote file containi...

Calendarix 0.7 Cross Site Scripting / Remote File Inclusion / SQL Injection

| | | / | / \ | \ | | | | / \ / | | |/| | | ' \ | | | | | | / | / \ | | | | | | / | | | | | | | | | | | || | | | \ \ | | | |\ | || | ,| || || | ./ / || |/ / || | || Calendarix alert'TeaMp0isoN' http://SITE.COM/PATH//calendar.php?y...

Calendarix 0.7 - 'calpath' Remote File Inclusion

source: https://www.securityfocus.com/bid/37673/info Calendarix is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the...

Sql injection

Multiple SQL injection vulnerabilities in Calendarix Basic 0.8.20071118 allow remote attackers to execute arbitrary SQL commands via 1 the catsearch parameter to calsearch.php or 2 the catview parameter to calcat.php. NOTE: vector 1 might overlap CVE-2007-3183.3, and vector 2 might overlap...

CVE-2008-2429

Multiple SQL injection vulnerabilities in Calendarix Basic 0.8.20071118 allow remote attackers to execute arbitrary SQL commands via 1 the catsearch parameter to calsearch.php or 2 the catview parameter to calcat.php. NOTE: vector 1 might overlap CVE-2007-3183.3, and vector 2 might overlap...

CVE-2008-2429

Multiple SQL injection vulnerabilities in Calendarix Basic 0.8.20071118 allow remote attackers to execute arbitrary SQL commands via 1 the catsearch parameter to calsearch.php or 2 the catview parameter to calcat.php. NOTE: vector 1 might overlap CVE-2007-3183.3, and vector 2 might overlap...

CVE-2008-2429

Summary of CVE-2008-2429 (Calendarix Basic): Two SQL injection vulnerabilities in Calendarix Basic 0.8.20071118 affect the catsearch and catview parameters (cal_search.php and cal_cat.php). The vulnerabilities arise because user input is not properly sanitized before being used in SQL queries, en...

Calendarix Basic cal_cat.php catview Parameter SQL Injection

The remote host is running Calendarix, a free, web-based calendar application written in PHP. The installed version of Calendarix does not validate user-supplied input to the 'catview ' parameter of the 'calcat.php' script before using it in database queries. Regardless of PHP's 'magicquotesgpc'...