CVE-2008-1344 Multiple SQL injection vulnerabilities in MyioSoft EasyCalendar 4.0tr and earlier allow remote attackers to execute arbitrary SQL commands via the (1) year parameter in a dayview action to plugins/cal...
HighCVSS 7.5
EPSS 1.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in MyioSoft EasyCalendar 4.0tr and earlier allow remote attackers to execute arbitrary SQL commands via the (1) year parameter in a dayview action to plugins/calendar/calendar_backend.php and the (2) page parameter to ajaxp_backend.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| myiosoft easycalendar | = 4.0tr | No fix listed |
References
- 29373 third-party-advisory vendor-advisory
- 20080317 EasyCalendar <= 4.0tr - Multiple Remote Vulnerabilities mailing-list
- 28232 exploit vdb-entry
- easycalendar-year-page-sql-injection(41179) vdb-entry
- 5246 exploit