PT-2006-1667 · 2200Net · 2200Net Calendar System

Aliaksandr Hartsuyeu · Published 2006-02-09 · Updated 2018-10-19 · CVE-2006-0610

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions 2200net Calendar system version 1.2

Description The issue allows remote attackers to execute arbitrary SQL commands and bypass authentication. This can be achieved via two methods:

• The fm data[id] parameter to "calendar.php"
• The $ad['acc'] variable in "adminlogin.php", when gpc magic quotes is disabled.

Recommendations For 2200net Calendar system version 1.2, consider disabling the gpc magic quotes disabled feature or restricting access to "calendar.php" and "adminlogin.php" until a patch is available. Avoid using the fm data[id] parameter in "calendar.php" and the $ad['acc'] variable in "adminlogin.php" to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-0610

Affected Products

2200Net Calendar System

References · 11

• http://evuln.com/vulns/62/summary.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0610 · Security Note
• http://secunia.com/advisories/18781 · Note
• http://osvdb.org/23037 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24483 · Note
• http://securityfocus.com/bid/16569 · Note
• http://osvdb.org/23038 · Note
• http://securityfocus.com/archive/1/425094/100/0/threaded · Note
• http://marc.info/?l=bugtraq&m=114003781801861&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24484 · Note
• http://vupen.com/english/advisories/2006/0486 · Note