Detections
Analytics
WebCalendar users.php user_valid_crypt Parameter < 1.0.0 SQL Injection
high Nessus Network Monitor Plugin ID 2628
Synopsis
The remote web server contains a script that is vulnerable to a SQL injection attack.Description
The remote host is running WebCalendar, a web-based calendar management program. This version of WebCalendar is vulnerable to a SQL injection attack via the user_valid_crypt parameter of the users.php script. An attacker exploiting this flaw would be able to read/modify data or execute commands as the web server process.Solution
Upgrade to version 1.0.0 or higher.See Also
http://sourceforge.net/project/shownotes.php?release_id=328057
Plugin Details
Severity: High
ID: 2628
Family: CGI
Published: 2/18/2005
Updated: 3/6/2019
Nessus ID: 18571
Risk Information
VPR
Risk Factor: Medium
Score: 5.5
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: High
Base Score: 7.3
Temporal Score: 7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:webcalendar:webcalendar
Reference Information
CVE: CVE-2005-0474, CVE-2005-2320