Multiple SQL Injection Vulnerabilities in WebCalendar

vendor:

WebCalendar

by:

SecurityFocus

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: WebCalendar

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2002

Multiple SQL Injection Vulnerabilities in WebCalendar

It has been reported that WebCalendar may be prone to multiple SQL injection issues in the view_t.php, view_w.php, view_v.php, and login.php modules of the software. The problems arise from a lack of sufficient sanitization of user-supplied input before being included in database queries. Successful exploitation of these vulnerabilities may allow a remote attacker to gain access to sensitive information stored in the underlying database. This information may then be used to launch further attacks against a vulnerable system.

Mitigation:

Input validation should be used to ensure that user-supplied input is properly sanitized before being included in database queries.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/8540/info

It has been reported that WebCalendar may be prone to multiple SQL injection issues in the view_t.php, view_w.php, view_v.php, and login.php modules of the software. The problems arise from a lack of sufficient sanitization of user-supplied input before being included in database queries.

Successful exploitation of these vulnerabilities may allow a remote attacker to gain access to sensitive information stored in the underlying database. This information may then be used to launch further attacks against a vulnerable system.

http://www.example.com/webcalendar/view_m.php?id=additional sql command
http://www.example.com/webcalendar/login.php?user='additional%20sqlcommand
http://www.example.com/webcalendar/login.php?password='additional%20sql%20command