PT-2005-4689 · Webcalendar · Webcalendar

Ascii

+1

·

Publicado

2005-12-01

·

Atualizado

2018-10-19

·

CVE-2005-3949

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions WebCalendar version 1.0.1
Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved through SQL injection vulnerabilities in several parameters, including the startid parameter to "activity log.php" and "admin handler.php", the template parameter to "edit template.php", and multiple parameters to "export handler.php".
Recommendations For WebCalendar version 1.0.1, avoid using the startid parameter in "activity log.php" and "admin handler.php", the template parameter in "edit template.php", and restrict access to "export handler.php" until a fix is available. Consider temporarily disabling the execution of SQL commands from these parameters as a quick mitigation measure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2005-3949
DSA-1002-1

Produtos afetados

Webcalendar