Detections
Analytics
Calendar Express Multiple Vulnerabilities (SQLi, XSS)
high Nessus Plugin ID 19749
Language:
Synopsis
The remote web server contains a PHP script that is vulnerable to cross-site scripting and SQL injection attacks.Description
The remote host is using Calendar Express, a PHP web calendar.Vulnerabilities exist in this version that could allow an attacker to execute arbitrary HTML and script code in the context of the user's browser, and SQL injection.
An attacker could exploit these flaws to use the remote host to perform attacks against third-party users, or to execute arbitrary SQL statements on the remote SQL database.
Solution
Upgrade to the latest version of this software.Plugin Details
Severity: High
ID: 19749
File Name: calendar_express_flaws.nasl
Version: 1.26
Type: remote
Family: CGI abuses
Published: 9/19/2005
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.6
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
Required KB Items: www/PHP
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 8/8/2005
Reference Information
CVE: CVE-2007-3627