RASPcalendar Admin Login Page Multiple SQL Injection Vulnerabilies
BID:63627
Info
RASPcalendar Admin Login Page Multiple SQL Injection Vulnerabilies
| Bugtraq ID: | 63627 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 08 2013 12:00AM |
| Updated: | Nov 08 2013 12:00AM |
| Credit: | Hackeri-AL |
| Vulnerable: |
RASPcalendar RASPcalendar 1.01 |
| Not Vulnerable: | |
Discussion
RASPcalendar Admin Login Page Multiple SQL Injection Vulnerabilies
RASPcalendar is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
RASPcalendar 1.01 is vulnerable; other versions may also be affected.
RASPcalendar is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
RASPcalendar 1.01 is vulnerable; other versions may also be affected.
Exploit / POC
RASPcalendar Admin Login Page Multiple SQL Injection Vulnerabilies
Attackers can use a browser to exploit this issue.
Attackers can use a browser to exploit this issue.
References
RASPcalendar Admin Login Page Multiple SQL Injection Vulnerabilies
References:
References:
- RASPcalendar HomePage (RASPcalendar)