by Kastro
Paper/Archive/CVE-2023-46700

CVE-2023-46700

LuxSoft LuxCal Web Calendar — SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite versio…

EPSS 1%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 63.7.637 × 2012.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary SQL command by sending a crafted request, and obtain or alter information stored in the database.

Affected

ProductAffectedFixed inSource
LuxCal Web Calendarprior to 5.2.4M (MySQL version)–CNA
LuxCal Web Calendarprior to 5.2.4L (SQLite version)–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refluxsoft.eurefluxsoft.eu/?downloadrefluxsoft.eu/lcforum/viewtopic.php?id=476refjvn.jp/en/jp/JVN15005948