Description
SQL injection vulnerability in the user_valid_crypt function in user.php in WebCalendar 0.9.45 allows remote attackers to execute arbitrary SQL commands via an encoded webcalendar_session cookie.
References
- 13918 vdb-entry
- 20050217 [ SCL-2005.001 ] - WebCalendar: SQL Injection from encoded cookie mailing-list
- webcalendar-sql-injection(19369) vdb-entry
- 1013231 vdb-entry
- 14319 third-party-advisory
- http://www.scovettalabs.com/advisory/SCL-2005.001.txt