PT-2007-7049 · Proverbs · Proverbs Web Calendar

Jose Luis Gngora Fernndez + 1 · Published 2007-11-29 · Updated 2018-10-15 · CVE-2007-6158

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Proverbs Web Calendar versions 1.1 and earlier

Description The issue concerns SQL injection vulnerabilities in the caladmin.inc.php file. Remote attackers can execute arbitrary SQL commands by manipulating the loginname (also known as Username) and loginpass (also known as Password) parameters in the caladmin.php file.

Recommendations For Proverbs Web Calendar versions 1.1 and earlier, as a temporary workaround, consider restricting access to the caladmin.php file until a patch is available. Avoid using the loginname and loginpass parameters in the caladmin.php file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2007-6158

Affected Products

Proverbs Web Calendar

References · 6

• 🔥 https://exploit-db.com/exploits/30810 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-6158 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38628 · Note
• http://securityreason.com/securityalert/3401 · Note
• http://securityfocus.com/bid/26584 · Note
• http://securityfocus.com/archive/1/484193/100/0/threaded · Note