CVE-2007-3183
Calendarix 0.7.20070307 - SQL Injection via Month/Year Parameters or Search String
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2007-3183. PoCs published by Jesper Jurcenoks.
AI-analyzed exploit summary This exploit demonstrates SQL injection vulnerabilities in Calendarix by injecting malicious SQL queries via the 'month' and 'year' parameters. The PoC extracts user credentials from the 'calendar_users' table.
Description
Multiple SQL injection vulnerabilities in Calendarix 0.7.20070307, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) month and (2) year parameters to calendar.php and the (3) search string to cal_search.php.
Exploits (1)
This exploit demonstrates SQL injection vulnerabilities in Calendarix by injecting malicious SQL queries via the 'month' and 'year' parameters. The PoC extracts user credentials from the 'calendar_users' table.