Vulnerability Scanning Solutions, LLC.
Our Process
What We Scan For
Sample Report
Client List
Contact Us
What We Scan For
Family: CGI abuses --> Category: attack

Calendarix id Parameter SQL Injection Vulnerabilities Vulnerability Scan

Vulnerability Scan Summary
Checks for id parameter SQL injection in Calendarix

Detailed Explanation for this Vulnerability Test

Synopsis :

The remote web server contains a PHP application that is susceptible
to multiple SQL injection attacks.

Description :

The remote host is running Calendarix, a free web-based calendar
application written in PHP.

The version of Calendarix installed on the remote host fails to
sanitize input to the 'id' parameter to the 'cal_event.php' and
'cal_popup.php' scripts before using it in database queries. Provided
PHP's 'magic_quotes_gpc' setting is disabled, an unauthenticated
attacker can exploit these flaws to manipulate database queries, which
may lead to disclosure of sensitive information, modification of data,
or attacks against the underlying database.

See also :

Solution :

Unknown at this time.

Threat Level:

Medium / CVSS Base Score : 4

Click HERE for more information and discussions on this network vulnerability scan.


P.O. Box 827051

Pembroke Pines, FL 33082-7051

Vulnerability Scanning Solutions, LLC.