PT-2005-1531 · Kessler Consulting · Webcalendar

Michael Scovetta · Publicado 2005-02-19 · Atualizado 2017-07-11 · CVE-2005-0474

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions WebCalendar version 0.9.45

Description A SQL injection issue exists in the user valid crypt function in user.php, allowing remote attackers to execute arbitrary SQL commands via an encoded webcalendar session cookie.

Recommendations For WebCalendar version 0.9.45, consider disabling the user valid crypt function in user.php as a temporary workaround until a patch is available. Restrict access to the user.php module to minimize the risk of exploitation. Avoid using the webcalendar session cookie in the affected API endpoint until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2005-0474

Produtos afetados

Webcalendar

Referências · 7

• 🔥 http://scovettalabs.com/advisory/SCL-2005.001.txt · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19369 · Nota
• http://marc.info/?l=bugtraq&m=110868446431706&w=2 · Nota
• http://secunia.com/advisories/14319 · Aviso do Fabricante
• http://securitytracker.com/id?1013231 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-0474 · Nota de Segurança
• http://osvdb.org/13918 · Nota