PT-2005-2822 · Calendarix · Calendarix Advanced

Published 2005-06-07 · Updated 2024-02-14 · CVE-2005-1865

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Calendarix Advanced version 1.5

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the catview parameter to API endpoints such as "/cal week.php", "/cal cat.php", or "/cal day.php", or the id parameter to "/cal pophols.php".

Recommendations For Calendarix Advanced version 1.5, consider restricting access to the catview parameter in the affected API endpoints and the id parameter in "/cal pophols.php" until a patch is available. As a temporary workaround, avoid using these parameters in the specified endpoints to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-1865

Affected Products

Calendarix Advanced

References · 11

• 🔥 http://securitytracker.com/alerts/2005/May/1014083.html · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2005-05/0356.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-1865 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1865 · Note
• http://osvdb.org/16971 · Note
• http://calendarix.com/download_basic.php · Note
• http://osvdb.org/16972 · Note
• http://secunia.com/advisories/15569 · Note
• http://calendarix.com/download_advanced.php · Note
• http://osvdb.org/16974 · Note
• http://osvdb.org/16975 · Note