Description
Multiple SQL injection vulnerabilities in Calendarix Basic 0.7.20060401 and earlier, with magic_quotes_gpc disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter in (1) cal_event.php and (2) cal_popup.php.
References
- 26528 vdb-entry
- 1016324 vdb-entry
- 26529 vdb-entry
- ADV-2006-2360 vdb-entry
- 20645 third-party-advisory
- 20060615 Calendarix 0.7.20060401, SQL Injection Vulnerabilities mailing-list
- calendarix-id-sql-injection(27186) vdb-entry