CVE-2004-1552 SQL injection vulnerability in aspWebCalendar allows remote attackers to execute arbitrary SQL statements via (1) the username field on the login page or (2) the eventid parameter to calendar.asp.
HighCVSS 7.5
EPSS 4.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
SQL injection vulnerability in aspWebCalendar allows remote attackers to execute arbitrary SQL statements via (1) the username field on the login page or (2) the eventid parameter to calendar.asp.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| full revolution aspwebcalendar | = 4.5 | No fix listed |
References
- 20040923 aspWebCalendar /aspWebAlbum: SQL injection mailing-list
- 12651 third-party-advisory vendor-advisory
- 24622 third-party-advisory
- 11246 exploit vdb-entry
- 23098 vdb-entry
- ADV-2007-1093 vdb-entry
- aspwebcalendar-sql-injection(17506) vdb-entry
- aspwebcalendar-calendar-sql-injection(33157) vdb-entry
- 3546 exploit