CVE-2005-4011

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 2.4%

from disclosure to weapon199 days

Published on NVDDec 5

1st PoC+199d

exploitation probability

2.4%top 18% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

SQL injection vulnerability in calendar.php in Codewalkers ltwCalendar (aka PHP Event Calendar) 4.2, 4.1.3, and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

Affected products

n/a · n/a

public PoCs found — 1✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/28088

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://ltwcalendar.sourceforge.net/changelog.php http://pridels0.blogspot.com/2005/11/codewalkers-ltwcalendar-4x-sql-inj.html http://secunia.com/advisories/17799 http://securitytracker.com/id?1016364 https://exchange.xforce.ibmcloud.com/vulnerabilities/23312 https://exchange.xforce.ibmcloud.com/vulnerabilities/27362 http://www.attrition.org/pipermail/vim/2006-December/001154.html http://www.osvdb.org/21195 http://www.osvdb.org/27539 http://www.securityfocus.com/archive/1/438232/100/0/threaded http://www.securityfocus.com/archive/1/438580/100/0/threaded http://www.securityfocus.com/bid/15636