PHP-Calendar SQL Credentials Information Disclosure Vulnerability

Bugtraq ID:	33656
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 06 2009 12:00AM
Updated:	Feb 09 2009 04:58PM
Credit:	Justin C. Klein Keane
Vulnerable:	PHP-Calendar PHP-Calendar 0.10.3 PHP-Calendar PHP-Calendar 0.10 PHP-Calendar PHP-Calendar 0.9.1 PHP-Calendar PHP-Calendar 0.9 PHP-Calendar PHP-Calendar 0.8 PHP-Calendar PHP-Calendar 0.7 PHP-Calendar PHP-Calendar 0.6 PHP-Calendar PHP-Calendar 0.5 PHP-Calendar PHP-Calendar 0.4 PHP-Calendar PHP-Calendar 0.3 PHP-Calendar PHP-Calendar 0.2 PHP-Calendar PHP-Calendar 0.1 PHP-Calendar PHP-Calendar 1.1 PHP-Calendar PHP-Calendar 1.0
Not Vulnerable:

PHP-Calendar SQL Credentials Information Disclosure Vulnerability

PHP-Calendar is prone to an information-disclosure vulnerability because it fails to restrict access to certain pages.

Attackers can exploit this issue to obtain sensitive information that may lead to further attacks.

PHP-Calendar 1.1 and prior versions are vulnerable.

PHP-Calendar SQL Credentials Information Disclosure Vulnerability

Attacker can exploit this issue through a browser.

PHP-Calendar SQL Credentials Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

PHP-Calendar SQL Credentials Information Disclosure Vulnerability

References:

• PHP-Calendar Homepage (PHP-Calendar)