Timeline |
| Disclosure Date |
Exploit Publish Date |
| 2007-06-30 |
2007-06-30 |
|
|
Description |
TotalCalendar contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'view_event.php' script not properly sanitizing user-supplied input to the 'id' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.
|
|
Classification |
Location:
Remote / Network Access
Attack Type:
Information Disclosure,
Input Manipulation
Impact:
Loss of Confidentiality,
Loss of Integrity
Solution:
Upgrade
Exploit:
Exploit Public
OSVDB:
Web Related
|
|
Solution |
Upgrade to version 2.403 (2007-07-11) or higher, as it has been reported to fix this vulnerability. Note that this flaw was fixed in the 2007-07-11 release without a change in version number. An upgrade is required as there are no known workarounds.
|
|
Products |
Unknown or Incomplete
|
|
|
|
|
|
|
|
|
BlogsThis product uses the Daylife API but is not endorsed or certified by Daylife.
|
This section lists the latest news and blogs found via the daylife API (and for older items, the technorati API), which mention or otherwise discuss this vulnerability.
None found at this time
|
|
|
