PT-2006-1728 · Unknown · Magic Calendar Lite

Aliaksandr Hartsuyeu · Publicado 2006-02-13 · Atualizado 2018-10-19 · CVE-2006-0673

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Magic Calendar Lite version 1.02

Description The issue concerns SQL injection vulnerabilities in the cms/index.php file. These vulnerabilities allow remote attackers to execute arbitrary SQL commands when magic quotes gpc is disabled. The vulnerable parameters are total login and total password.

Recommendations For Magic Calendar Lite version 1.02, consider disabling the execution of SQL commands via the total login and total password parameters until a patch is available. Restrict access to the cms/index.php file to minimize the risk of exploitation. Avoid using the total login and total password parameters in the affected API endpoint until the issue is resolved. Enable magic quotes gpc to prevent SQL injection attacks.

Exploit

Correção

Identificadores relacionados

CVE-2006-0673

Produtos afetados

Magic Calendar Lite

Referências · 11

• 🔥 https://exploit-db.com/exploits/27251 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-0673 · Nota de Segurança
• http://evuln.com/vulns/71/summary.html · Aviso do Fabricante
• http://secunia.com/advisories/18855 · Nota
• http://vupen.com/english/advisories/2006/0525 · Nota
• http://securityfocus.com/bid/16734 · Nota
• http://securitytracker.com/id?1015650 · Nota
• http://securityfocus.com/archive/1/425491/100/0/threaded · Nota
• http://securityfocus.com/bid/16646 · Nota
• http://securityreason.com/securityalert/459 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24588 · Nota