PT-2006-1728 · Unknown · Magic Calendar Lite

Aliaksandr Hartsuyeu · Published 2006-02-13 · Updated 2018-10-19 · CVE-2006-0673

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Magic Calendar Lite version 1.02

Description The issue concerns SQL injection vulnerabilities in the cms/index.php file. These vulnerabilities allow remote attackers to execute arbitrary SQL commands when magic quotes gpc is disabled. The vulnerable parameters are total login and total password.

Recommendations For Magic Calendar Lite version 1.02, consider disabling the execution of SQL commands via the total login and total password parameters until a patch is available. Restrict access to the cms/index.php file to minimize the risk of exploitation. Avoid using the total login and total password parameters in the affected API endpoint until the issue is resolved. Enable magic quotes gpc to prevent SQL injection attacks.

Exploit

Fix

Related Identifiers

CVE-2006-0673

Affected Products

Magic Calendar Lite

References · 11

• 🔥 https://exploit-db.com/exploits/27251 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-0673 · Security Note
• http://evuln.com/vulns/71/summary.html · Vendor Advisory
• http://secunia.com/advisories/18855 · Note
• http://vupen.com/english/advisories/2006/0525 · Note
• http://securityfocus.com/bid/16734 · Note
• http://securitytracker.com/id?1015650 · Note
• http://securityfocus.com/archive/1/425491/100/0/threaded · Note
• http://securityfocus.com/bid/16646 · Note
• http://securityreason.com/securityalert/459 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24588 · Note