high7.5Public exploit code
CVE-2009-4973
SQL injection vulnerability in rss.php in TotalCalendar 2.4 allows remote attackers to execute arbitrary SQL commands via the selectedCal parameter in a Switch…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- totalcalendar 2.4 - Blind SQL Injection / Local File Inclusion2009-08-26 · webapps · php · Verified
Impact
SQL injection vulnerability in rss.php in TotalCalendar 2.4 allows remote attackers to execute arbitrary SQL commands via the selectedCal parameter in a SwitchCal action.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sweetphp | Totalcalendar | Version 2.4 |