ASP Inline Corporate Calendar Cross Site Scripting and SQL Injection Vulnerabilities

Bugtraq ID:	35054
Class:	Input Validation Error
CVE:	CVE-2009-2241 CVE-2009-2242
Remote:	Yes
Local:	No
Published:	May 21 2009 12:00AM
Updated:	Jul 09 2009 05:46PM
Credit:	Bl@ckbe@rD
Vulnerable:	Aaron's Outpost ASP Inline Corporate Calendar 0
Not Vulnerable:

ASP Inline Corporate Calendar Cross Site Scripting and SQL Injection Vulnerabilities

ASP Inline Corporate Calendar is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

ASP Inline Corporate Calendar Cross Site Scripting and SQL Injection Vulnerabilities

An attacker can exploit these issues via a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.

The following examples are available:

• /data/vulnerabilities/exploits/35054.html

ASP Inline Corporate Calendar Cross Site Scripting and SQL Injection Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

ASP Inline Corporate Calendar Cross Site Scripting and SQL Injection Vulnerabilities

References:

• ASP Inline Calendar Homepage (Aaron Outpost)