|
|
Family: CGI abuses --> Category: attack
Calendarix id Parameter SQL Injection Vulnerabilities Vulnerability Scan
Vulnerability Scan Summary
Checks for id parameter SQL injection in Calendarix
Detailed Explanation for this Vulnerability Test
Synopsis :
The remote web server contains a PHP application that is susceptible
to multiple SQL injection attacks.
Description :
The remote host is running Calendarix, a free web-based calendar
application written in PHP.
The version of Calendarix installed on the remote host fails to
sanitize input to the 'id' parameter to the 'cal_event.php' and
'cal_popup.php' scripts before using it in database queries. Provided
PHP's 'magic_quotes_gpc' setting is disabled, an unauthenticated
attacker can exploit these flaws to manipulate database queries, which
may lead to disclosure of sensitive information, modification of data,
or attacks against the underlying database.
See also :
http://www.securityfocus.com/archive/1/437437/30/0/threaded
Solution :
Unknown at this time.
Threat Level:
Medium / CVSS Base Score : 4
(AV:R/AC:H/Au:NR/C:P/A:N/I:P/B:N)
Click HERE for more information and discussions on this network vulnerability scan.
|
