Vulnerabilities > CVE-2005-0474 - SQL-Injection vulnerability in Webcalendar 0.9.45

047910
CVSS 6.4 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
NONE
network
low complexity
webcalendar
nessus
NVD
Published: 2005-03-30
Updated: 2017-07-11

Summary

SQL injection vulnerability in the user_valid_crypt function in user.php in WebCalendar 0.9.45 allows remote attackers to execute arbitrary SQL commands via an encoded webcalendar_session cookie.

Vulnerable Configurations

Part Description Count
Application
Webcalendar
1

Nessus

NASL familyCGI abuses
NASL idWEBCALENDAR_SQL2.NASL
descriptionThe remote version of WebCalendar contains a SQL injection vulnerability that may allow an attacker to execute arbitrary SQL statements against the remote database. An attacker may be able to leverage this issue to, for example, delete arbitrary database tables.
last seen2020-06-01
modified2020-06-02
plugin id17142
published2005-02-18
reporterThis script is Copyright (C) 2005-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/17142
titleWebCalendar login.php webcalendar_session Cookie SQL Injection

References