108 matches found
Calendarix version 0.7. 20070307 Multiple XSS Attacks
netVigilance Security Advisory 37 Calendarix version 0.7. 20070307 Multiple XSS Attacks Description: Calendarix is a powerful and easy to use calendar based on PHP and MySQL. It has been developed with ease of use and quick access to information in mind. It provides the user with the quickest...
Calendarix SQL注入漏洞
Calendarix是一款基于PHP的WEB应用程序。 Calendarix不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击获得敏感信息。 问题是由于'index.php'脚本对用户提交的'month'和'year'参数缺少过滤，提交恶意SQL查询作为参数数据，可导致应用程序处理时更改原来的SQL逻辑，攻击者可以获得敏感信息或者操作数据库。 Calendarix 0.7.20070307 目前没有解决方案提供： http://www.calendarix.com/ http://www.example.com/calendar.php?month=' UNION...
Calendarix 0.7.20070307 - Multiple Cross-Site Scripting Vulnerabilities
Calendarix 0.7.20070307 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/24626/info Calendrix is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to...
Calendarix <= 0.7.20070307 calendar.php month and year parameter SQL Injection
Binary data 4113.prm...
Calendarix 0.7.20070307 - Multiple Cross-Site Scripting Vulnerabilities
source: https://www.securityfocus.com/bid/24626/info Calendrix is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...
Calendarix 0.7.20070307 - Multiple SQL Injections
source: https://www.securityfocus.com/bid/24633/info Calendarix is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or...
Calendarix 0.7.20070307 - Multiple SQL Injections
Calendarix 0.7.20070307 - Multiple SQL Injections source: https://www.securityfocus.com/bid/24633/info Calendarix is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an...
CalendarixCalPath远程文件包含漏洞
Calendarix是运行在PHP和MySQL上的基于Web的日历。Calendarix在处理文件包含时存在问题，远程攻击者可能利用此漏洞在主机上执行任意命令。Calendarix中存在远程文件包含漏洞，起因是应用程序没能正确的过滤用户提供的输入。攻击者可以利用这个漏洞在受影响的机器上以Web Server进程的权限执行任意服务器端脚本。 Advanced 1.5.20050501 如果您不能立刻安装补丁或者升级， 建议您采取以下措施以降低威胁： 禁用allowurlfopen和registerglobals命令。 厂商补丁： Calendarix ----------...
calendarix07.txt
--------------------------------------------------------------------------------------- Calendarix 0.7 calpath Remote File Inclusion --------------------------------------------------------------------------------------- Author : Sh3ll Date : 2006/08/11 HomePage : http://www.sh3ll.ir Contact :...
CVE-2006-4135
Calendarix
CVE-2006-4135
PHP remote file inclusion vulnerability in calconfig.inc.php in Calendarix 0.7.20060401 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the calpath parameter. NOTE: this issue has been disputed by a third party, who says that the affected $calpath variable is set to...
Calendarix <= 0.7 (calpath) Remote File Inclusion Vulnerability
--------------------------------------------------------------------------------------- Calendarix 0.7 calpath Remote File Inclusion --------------------------------------------------------------------------------------- Author : Sh3ll Date : 2006/08/11 HomePage : http://www.sh3ll.ir Contact :...
PT-2006-4976 · Calendarix · Calendarix
Name of the Vulnerable Software and Affected Versions: Calendarix versions prior to 0.7.20060401 Description: A remote file inclusion issue allows attackers to execute arbitrary PHP code via a URL in the calpath parameter. However, this issue has been disputed by a third party, who claims that th...
FSA-018.txt
----------------------------------------------------- Advisory id: FSA:018 Author: Federico Fazzi Date: 15/06/2006, 23:36 Sinthesis: Calendarix 0.7.20060401, SQL Injection Vulnerabilities Type: low Product: http://www.calendarix.com/ Patch: unavailable...
CVE-2006-3094
Multiple SQL injection vulnerabilities in Calendarix Basic 0.7.20060401 and earlier, with magicquotesgpc disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter in 1 calevent.php and 2 calpopup.php...
CVE-2006-3094
CVE-2006-3094 affects Calendarix Basic 0.7.20060401 and earlier. The vulnerability is an SQL injection in the id parameter of cal_event.php and cal_popup.php when magic_quotes_gpc is disabled, allowing remote attackers to execute arbitrary SQL commands. This is evidenced by multiple public adviso...
CVE-2006-3094
Multiple SQL injection vulnerabilities in Calendarix Basic 0.7.20060401 and earlier, with magicquotesgpc disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter in 1 calevent.php and 2 calpopup.php...
Calendarix 0.7.20060401, SQL Injection Vulnerabilities
----------------------------------------------------- Advisory id: FSA:018 Author: Federico Fazzi Date: 15/06/2006, 23:36 Sinthesis: Calendarix 0.7.20060401, SQL Injection Vulnerabilities Type: low Product: http://www.calendarix.com/ Patch: unavailable...
Calendarix 0.7.20060401, SQL Injection Vulnerabilities
----------------------------------------------------- Advisory id: FSA:018 Author: Federico Fazzi Date: 15/06/2006, 23:36 Sinthesis: Calendarix 0.7.20060401, SQL Injection Vulnerabilities Type: low Product: http://www.calendarix.com/ Patch: unavailable...
Calendarix Multiple Script id Parameter SQL Injection
The remote host is running Calendarix, a free web-based calendar application written in PHP. The version of Calendarix installed on the remote host fails to sanitize input to the 'id' parameter to the 'calevent.php' and 'calpopup.php' scripts before using it in database queries. Provided PHP's...