PT-2005-2822 · Calendarix · Calendarix Advanced

Published 2005-06-07 · Updated 2024-02-14 · CVE-2005-1865

Positive Technologies · (AI Summary)

CVSS v2.0

7.5

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions:

Calendarix Advanced version 1.5

Description:

The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the `catview` parameter to API endpoints such as "/cal week.php", "/cal cat.php", or "/cal day.php", or the `id` parameter to "/cal pophols.php".

Recommendations:

For Calendarix Advanced version 1.5, consider restricting access to the `catview` parameter in the affected API endpoints and the `id` parameter in "/cal pophols.php" until a patch is available. As a temporary workaround, avoid using these parameters in the specified endpoints to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-1865

Affected Products

Calendarix Advanced

References · 11

• 🔥 http://securitytracker.com/alerts/2005/May/1014083.html · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2005-05/0356.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-1865 · Security Note
• http://calendarix.com/download_advanced.php · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1865 · Note
• http://osvdb.org/16972 · Note
• http://secunia.com/advisories/15569 · Note
• http://osvdb.org/16971 · Note
• http://osvdb.org/16974 · Note
• http://osvdb.org/16975 · Note
• http://calendarix.com/download_basic.php · Note