[SA18792] PHP Event Calendar User Information Manipulation

TITLE: PHP Event Calendar User Information Manipulation SECUNIA ADVISORY ID: SA18792 VERIFY ADVISORY: http://secunia.com/advisories/18792/ CRITICAL: Less critical IMPACT: Cross Site Scripting, Manipulation of data WHERE: From remote SOFTWARE: PHP Event Calendar 1.x http://secunia.com/product/7964...

vbulletin352.txt

Vulnerable Version: 3.5.2 prior versions also may be affected Bug: HtmlInjection Second order CrossSiteScripting Exploitation: Remote with browser HtmlInjection : The software does not properly filter HTML tags in the title of events before being passed to user in 'calendar.php'&'reminder.php AS...

CVE-2005-4011

The CVE-2005-4011 vulnerability affects Codewalkers ltwCalendar (aka PHP Event Calendar) and involves a SQL injection in calendar.php via the id parameter. Affected versions are 4.2, 4.1.3 and earlier. The underlying issue is improper input handling that allows remote attackers to execute arbitra...

CVE-2005-3933

SQL injection vulnerability in index.php in 88Script's Event Calendar 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the m parameter...

CVE-2005-3933

CVE-2005-3933 affects 88Script’s Event Calendar 2.0 and earlier. It is an SQL injection in index.php exploitable via the m parameter , enabling remote attackers to execute arbitrary SQL commands. Impact is noted as partial on confidentiality, integrity, and availability. The provided documents do...

CVE-2005-3933

SQL injection vulnerability in index.php in 88Script's Event Calendar 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the m parameter...

CVE-2005-3933: Undefined Security Weakness

SQL injection vulnerability in index.php in 88Script's Event Calendar 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the m parameter...

88Script's Event Calendar v2.0 SQL inj. vuln.

88Script's Event Calendar v2.0 SQL inj. vuln. Vuln. dicovered by : r0t Date: 29 nov. 2005 Orginal advisory:http://pridels.blogspot.com/2005/11/88scripts-event-calendar-v20-sql-inj.html Vendor:http://www.88scripts.com/ affected version: v2.0 and prior Product Description: A simple yet elegant even...

CVE-2004-1528

The CVE-2004-1528 issue affects the Event Calendar module 2.13 for PHP-Nuke. It allows remote attackers to disclose sensitive information by triggering errors in HTTP requests to config.php, index.php, or submit.php, revealing the full path in an error message. The documentation does not specify ...

CVE-2004-1529

CVE-2004-1529 refers to a Cross-site Scripting (XSS) vulnerability in the Event Calendar module 2.13 for PHP-Nuke. The issue allows remote attackers to trigger script execution by supplying malicious input in the Preview operation via the parameters (type, day, month, year) or in event comments. ...

CVE-2004-1530

CVE-2004-1530 is a SQL injection vulnerability in the PHP-Nuke Event Calendar module 2.13. The flaw is triggered by unsanitized input in the (1) eid and (2) cid parameters, allowing remote attackers to execute arbitrary SQL commands. Documented impact indicates potential for partial confidentiali...

CVE-2004-1528

The Event Calendar module 2.13 for PHP-Nuke allows remote attackers to gain sensitive information via an HTTP request to 1 config.php, 2 index.php, or 3 submit.php, which reveal the full path in an error message...

CVE-2004-1530

SQL injection vulnerability in the Event Calendar module 2.13 for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the 1 eid or 2 cid parameters...

CVE-2004-1529

Cross-site scripting XSS vulnerability in the Event Calendar module 2.13 for PHP-Nuke allows remote attackers to execute arbitrary web script via the 1 type, 2 day, 3 month, or 4 year parameters in a Preview operation, or 5 event comments...

CVE-2004-1528: Undefined Security Weakness

The Event Calendar module 2.13 for PHP-Nuke allows remote attackers to gain sensitive information via an HTTP request to 1 config.php, 2 index.php, or 3 submit.php, which reveal the full path in an error message...

CVE-2004-1529: Undefined Security Weakness

Cross-site scripting XSS vulnerability in the Event Calendar module 2.13 for PHP-Nuke allows remote attackers to execute arbitrary web script via the 1 type, 2 day, 3 month, or 4 year parameters in a Preview operation, or 5 event comments...

CVE-2004-1530: Undefined Security Weakness

SQL injection vulnerability in the Event Calendar module 2.13 for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the 1 eid or 2 cid parameters...

CVE-2004-1528

The Event Calendar module 2.13 for PHP-Nuke allows remote attackers to gain sensitive information via an HTTP request to 1 config.php, 2 index.php, or 3 submit.php, which reveal the full path in an error message...

CVE-2004-1530

SQL injection vulnerability in the Event Calendar module 2.13 for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the 1 eid or 2 cid parameters...

CVE-2004-1529

Cross-site scripting XSS vulnerability in the Event Calendar module 2.13 for PHP-Nuke allows remote attackers to execute arbitrary web script via the 1 type, 2 day, 3 month, or 4 year parameters in a Preview operation, or 5 event comments...