Simple PHP Agenda 'edit_event.php' SQL Injection Vulnerability

Bugtraq ID:	60481
Class:	Input Validation Error
CVE:	CVE-2013-3961
Remote:	Yes
Local:	No
Published:	Jun 11 2013 12:00AM
Updated:	Jun 11 2013 12:00AM
Credit:	Anthony Dubuissez
Vulnerable:
Not Vulnerable:

Simple PHP Agenda 'edit_event.php' SQL Injection Vulnerability

Simple PHP Agenda is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Simple PHP Agenda 2.2.8 and prior versions are vulnerable.

Simple PHP Agenda 'edit_event.php' SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

The following example URI is available:

http://www.example.com/edit_event.php?eventid=1%20union%20select%201,2,3,username,password,6,7,8,9%20from%20users%20where%20userlevel=9%20limit%200,1

Simple PHP Agenda 'edit_event.php' SQL Injection Vulnerability

Solution:
Reportedly the issue is fixed, however Symantec has not confirmed this. Please contact the vendor for more information.

Simple PHP Agenda 'edit_event.php' SQL Injection Vulnerability

References:

• Simple PHP Agenda SourceForge Page (Simple PHP Agenda)