CVE-2004-1552 EXPLOIT
7.5
HIGH · CVSS 2.0 · EPSS 4.1% (pctl 90)
Patch early
A public exploit exists.
Description
SQL injection vulnerability in aspWebCalendar allows remote attackers to execute arbitrary SQL statements via (1) the username field on the login page or (2) the eventid parameter to calendar.asp.
Scoring
| CVSS | 7.5 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| EPSS | 4.08% — more likely to be exploited than 90% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2004-12-31 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| full revolution | aspwebcalendar |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Web Calendar System 3.12/3.30 - Multiple Vulnerabilities | 2008-11-27 |
| exploit-db | AspWebCalendar 4.5 - 'eventid' SQL Injection | 2007-03-22 |
References
- http://marc.info/?l=bugtraq&m=109604910025090&w=2
- http://secunia.com/advisories/12651
- http://secunia.com/advisories/24622
- http://www.securityfocus.com/bid/11246
- http://www.securityfocus.com/bid/23098
- http://www.vupen.com/english/advisories/2007/1093
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17506
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33157
- https://www.exploit-db.com/exploits/3546
- http://marc.info/?l=bugtraq&m=109604910025090&w=2
- http://secunia.com/advisories/12651
- http://secunia.com/advisories/24622
- http://www.securityfocus.com/bid/11246
- http://www.securityfocus.com/bid/23098
- http://www.vupen.com/english/advisories/2007/1093
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17506
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33157
- https://www.exploit-db.com/exploits/3546
→ the Explorer · watch your stack · NVD