PT-2010-1776 · Totalcalendar · Totalcalendar

Moudi · Publicado 2010-07-27 · Atualizado 2017-09-19 · CVE-2009-4973

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TotalCalendar version 2.4

Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the selectedCal parameter in a SwitchCal action within the rss.php file.

Recommendations For TotalCalendar version 2.4, consider restricting access to the rss.php file or the SwitchCal action to minimize the risk of exploitation. Avoid using the selectedCal parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-4973

Produtos afetados

Totalcalendar

Referências · 3

• 🔥 http://exploit-db.com/exploits/9524 · Exploit
• 🔥 https://exploit-db.com/exploits/9524 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4973 · Nota de Segurança