CVE-2007-3519
phpEventCalendar < 0.2.3 - SQL Injection via eventdisplay.php id Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2007-3519. PoCs published by AtT4CKxT3rR0r1ST, Iron.
AI-analyzed exploit summary The exploit demonstrates SQL injection (classic and blind), CSRF for admin addition, and XSS vulnerabilities in phpEventCalendar v0.2.3. It includes proof-of-concept URLs and a form for CSRF exploitation.
Description
SQL injection vulnerability in eventdisplay.php in phpEventCalendar 0.2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
Exploits (2)
The exploit demonstrates SQL injection (classic and blind), CSRF for admin addition, and XSS vulnerabilities in phpEventCalendar v0.2.3. It includes proof-of-concept URLs and a form for CSRF exploitation.
This exploit targets a SQL injection vulnerability in phpEventCalendar <= v0.2.3. It retrieves the username and password of a specified user ID by injecting a UNION-based SQL query into the 'id' parameter of eventdisplay.php.