PT-2007-7049 · Proverbs · Proverbs Web Calendar

Jose Luis Gngora Fernndez + 1 · Publicado 2007-11-29 · Atualizado 2018-10-15 · CVE-2007-6158

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Proverbs Web Calendar versions 1.1 and earlier

Description The issue concerns SQL injection vulnerabilities in the caladmin.inc.php file. Remote attackers can execute arbitrary SQL commands by manipulating the loginname (also known as Username) and loginpass (also known as Password) parameters in the caladmin.php file.

Recommendations For Proverbs Web Calendar versions 1.1 and earlier, as a temporary workaround, consider restricting access to the caladmin.php file until a patch is available. Avoid using the loginname and loginpass parameters in the caladmin.php file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2007-6158

Produtos afetados

Proverbs Web Calendar

Referências · 6

• 🔥 https://exploit-db.com/exploits/30810 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38628 · Nota
• http://securityreason.com/securityalert/3401 · Nota
• http://securityfocus.com/bid/26584 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-6158 · Nota de Segurança
• http://securityfocus.com/archive/1/484193/100/0/threaded · Nota