PT-2008-3898 · Vincent Hor+1 · Calendarix Advanced+1

Published 2008-11-26 · Updated 2008-11-26 · CVE-2008-2429

Mitre

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Multiple SQL injection vulnerabilities in Calendarix Basic 0.8.20071118 allow remote attackers to execute arbitrary SQL commands via (1) the catsearch parameter to cal search.php or (2) the catview parameter to cal cat.php. NOTE: vector 1 might overlap CVE-2007-3183.3, and vector 2 might overlap CVE-2005-1865.2.

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-2429

Affected Products

Calendarix Advanced

Basic

References · 4

• http://secunia.com/secunia_research/2008-28/advisory · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2429 · Security Note
• http://secunia.com/advisories/30710 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2429 · Note