CVE-2006-2973

PHP Lite Calendar Express 2.2 - SQL Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-2973. PoCs published by CrAzY CrAcKeR.

AI-analyzed exploit summary The provided text describes an SQL injection vulnerability in Calendar Express, where unsanitized user input in the 'cid' or 'catid' parameters can be exploited to manipulate SQL queries. No actual exploit code is included, only URLs demonstrating the vulnerability.

Description

Multiple SQL injection vulnerabilities in month.php in PHP Lite Calendar Express 2.2 allow remote attackers to execute arbitrary SQL commands via the (1) catid and (2) cid parameter. NOTE: this might be a duplicate of CVE-2005-4009.c.

Exploits (1)

exploitdb WRITEUP VERIFIED
by CrAzY CrAcKeR · textwebappsphp
https://www.exploit-db.com/exploits/27990

The provided text describes an SQL injection vulnerability in Calendar Express, where unsanitized user input in the 'cid' or 'catid' parameters can be exploited to manipulate SQL queries. No actual exploit code is included, only URLs demonstrating the vulnerability.

Classification
Writeup 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Theoretical
Target: Calendar Express (version not specified)
No auth needed
Prerequisites: Access to the vulnerable Calendar Express application
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/2220
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/18314
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/1089
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/436334/100/0/threaded

Scores

EPSS 0.0109
EPSS Percentile 61.0%

Details

CWE
CWE-89
Status published
Products (1)
php_lite/calendar_express 2.2
Published Jun 12, 2006
Tracked Since Feb 18, 2026