by Kastro
Paper/Archive/CVE-2023-39939

CVE-2023-39939

LuxSoft LuxCal Web Calendar — SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and LuxCal Web Calendar prior to 5.2.3L (SQLite versio…

EPSS 1.0%CVSS 9.1
critical.is priorityof 100
40
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 61.7.617 × 2012.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and LuxCal Web Calendar prior to 5.2.3L (SQLite version) allows a remote unauthenticated attacker to execute arbitrary queries against the database and obtain or alter the information in it.

Affected

ProductAffectedFixed inSource
LuxCal Web Calendarprior to 5.2.3M (MySQL version)–CNA
LuxCal Web Calendarprior to 5.2.3L (SQLite version)–CNA
web_calendar< 5.2.3M5.2.3MCISA-ADP
web_calendar< 5.2.3L5.2.3LCISA-ADP

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refluxsoft.eurefluxsoft.eu/?downloadrefjvn.jp/en/jp/JVN04876736