vendor:
JE Ajax event calendar
by:
L0rd CrusAd3r aka VSN
8,8
CVSS
HIGH
SQL Vulnerability
89
CWE
Product Name: JE Ajax event calendar
Affected Version From: 1.0.5
Affected Version To: 1.0.5
Patch Exists: Yes
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2010
Joomla JE Ajax event calendar SQL Vulnerable
The Joomla JE Ajax event calendar component has a SQL vulnerability which allows an attacker to inject malicious SQL queries into the application. The vulnerability is present in the 'view' parameter of the component, which can be exploited to execute arbitrary SQL commands. The attacker can use this vulnerability to gain access to sensitive information stored in the database, such as user credentials and other confidential data.
Mitigation:
The vendor should patch the vulnerability by properly validating user input and sanitizing the 'view' parameter.
