Unscored CVE-2006-6030 EUVD-2006-6013GHSA-crh3-8h4m-5j8m

Multiple SQL injection vulnerabilities in E-Calendar Pro 3.0 allow remote attackers to execute arbitrary SQL commands via the (1) username …

Published Nov 21, 2006 · Updated Aug 7, 2024 · Assigned by mitre

Description

Multiple SQL injection vulnerabilities in E-Calendar Pro 3.0 allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) passwd (Password) fields in (a) admin/default.asp; or the (3) Event Title, (4) Location, or (5) Description field when making a search engine query in (b) search.asp. NOTE: some of these details are obtained from third party information.

References

ecalendar-login-sql-injection(30305) vdb-entry
22897 third-party-advisory
20061115 E-Calendar Pro 3.0 [ login bypass & injection sql (post)] mailing-list
1897 third-party-advisory
ADV-2006-4534 vdb-entry