vBulletin calendar.php eventid Parameter SQL Injection

A vulnerability has been discovered in the 'calendar.php' script that allows unauthorized users to inject SQL commands through the 'eventid' parameter. An attacker may use this flaw to gain the control of the remote database. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref: From:...

vbulletinSQL.txt

vBulletin Forum 2.3.xx calendar.php SQL Injection ======================================================== Website: www.safechina.net Discovered by: mslug [email protected] Description: ============= There exist a sql injection problem in calendar.php. Notice the eventid field. -------- Cut fr...