PT-2009-2078 · Develop It Easy · Developiteasy Events Calendar

Cyb3R-1St · Published 2009-04-06 · Updated 2017-09-29 · CVE-2008-6608

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DevelopItEasy Events Calendar version 1.2

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the "user name" parameter to "admin/index.php", the "user pass" parameter to "admin/index.php", or the id parameter to "calendar details.php".

Recommendations For DevelopItEasy Events Calendar version 1.2, consider restricting access to the vulnerable parameters user name and user pass in the "admin/index.php" endpoint, as well as the id parameter in the "calendar details.php" endpoint, until a fix is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-6608

Affected Products

Developiteasy Events Calendar

References · 7

• 🔥 https://exploit-db.com/exploits/7013 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-6608 · Security Note
• http://secunia.com/advisories/32596 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46395 · Note
• http://securityfocus.com/bid/32148 · Note
• http://osvdb.org/49756 · Note
• http://osvdb.org/49755 · Note