PT-2005-1531 · Kessler Consulting · Webcalendar

Michael Scovetta · Published 2005-02-19 · Updated 2017-07-11 · CVE-2005-0474

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions WebCalendar version 0.9.45

Description A SQL injection issue exists in the user valid crypt function in user.php, allowing remote attackers to execute arbitrary SQL commands via an encoded webcalendar session cookie.

Recommendations For WebCalendar version 0.9.45, consider disabling the user valid crypt function in user.php as a temporary workaround until a patch is available. Restrict access to the user.php module to minimize the risk of exploitation. Avoid using the webcalendar session cookie in the affected API endpoint until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2005-0474

Affected Products

Webcalendar

References · 7

• 🔥 http://scovettalabs.com/advisory/SCL-2005.001.txt · Exploit
• http://secunia.com/advisories/14319 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0474 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19369 · Note
• http://marc.info/?l=bugtraq&m=110868446431706&w=2 · Note
• http://securitytracker.com/id?1013231 · Note
• http://osvdb.org/13918 · Note