Description
SQL injection vulnerability in calendar.php for Invision Power Board 1.3 allows remote attackers to execute arbitrary SQL commands via the m parameter, which sets the $this->chosen_month variable.
References
- 3319 vdb-entry
- http://forums.invisionpower.com/index.php?act=ST&f=1&t=108786
- 9353 vdb-entry
- 20040103 [SCSA-025] Invision Power Board SQL Injection Vulnerability mailing-list
- 10530 third-party-advisory
- 1008589 vdb-entry