CVE-2006-1372 : Multiple SQL injection vulnerabilities in 1WebCalendar 4.0 and earlier allow rem

Multiple SQL injection vulnerabilities in 1WebCalendar 4.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) EventID parameter in viewEvent.cfm, (2) NewsID parameter in newsView.cfm, or (3) ThisDate parameter in mainCal.cfm.

Published 2006-03-24 02:02:00

Updated 2025-04-03 01:03:51

Source MITRE

View at NVD, CVE.org

Vulnerability category: Sql Injection

Products affected by CVE-2006-1372

Benson It Solutions » 1webcalendar
Versions up to, including, (<=) 4.0
cpe:2.3:a:benson_it_solutions:1webcalendar:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2006-1372

EPSS FAQ

0.67%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 69 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2006-1372

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None

Vendor statements for CVE-2006-1372

Benson Solutions 2007-01-03

WebCalendar v4 has been updated to include fixes that filter the url numeric and date variables in question and prevent non-numeric and non-date values from being passed to the SQL queries. This fixes the problems with the pages in question. http://www.bensonitsolutions.com/Calendar/v4/

References for CVE-2006-1372

Jump to

Vulnerability Details : CVE-2006-1372

Products affected by CVE-2006-1372

Exploit prediction scoring system (EPSS) score for CVE-2006-1372

CVSS scores for CVE-2006-1372

Vendor statements for CVE-2006-1372

References for CVE-2006-1372