Description
SQL injection vulnerability in admincp/admincalendar.php in vBulletin 3.7.3.pl1 allows remote authenticated administrators to execute arbitrary SQL commands via the holidayinfo[recurring] parameter, a different vector than CVE-2005-3022.
References
- vbulletin-admincalendar-sql-injection(46683) vdb-entry
- 20081117 [waraxe-2008-SA#068] - Sql Injection in vBulletin 3.7.3.pl1 mailing-list
- http://www.waraxe.us/advisory-68.html
- 32735 third-party-advisory