CVE-2011-5109 - Vulnerability Details - OpenCVE

Multiple SQL injection vulnerabilities in Freelancer calendar 1.01 and earlier allow remote attackers to inject arbitrary web script or HTML via the SearchField parameter in a search action to (1) category_list.php, (2) Copy_of_calendar_list.php, (3) customer_statistics_list.php, (4) customer_list.php, and (5) task_statistics_list.php in the worldcalendar directory.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
John Geo	Freelancer Calendar

Configuration 1 [-]

cpe:2.3:a:john_geo:freelancer_calendar:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://archives.neohapsis.com/archives/fulldisclosure/2011-11/0305.html
http://osvdb.org/77244
http://osvdb.org/77245
http://osvdb.org/77246
http://osvdb.org/77247
http://osvdb.org/77248
http://secunia.com/advisories/46970
http://www.exploit-db.com/exploits/18127
http://www.securityfocus.com/archive/1/520573/100/0/threaded
http://www.securityfocus.com/bid/50733
https://exchange.xforce.ibmcloud.com/vulnerabilities/71403

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2012-08-23T20:00:00

Updated: 2024-08-07T00:23:40.185Z

Reserved: 2012-08-23T00:00:00

Link: CVE-2011-5109

Vulnrichment

No data.

NVD

Status : Modified

Published: 2012-08-23T20:55:02.483

Modified: 2024-11-21T01:33:39.460

Link: CVE-2011-5109

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2011-11-18T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in Freelancer calendar 1.01 and earlier allow remote attackers to inject arbitrary web script or HTML via the SearchField parameter in a search action to (1) category_list.php, (2) Copy_of_calendar_list.php, (3) customer_statistics_list.php, (4) customer_list.php, and (5) task_statistics_list.php in the worldcalendar directory."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-09T18:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "77248", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/77248"}, {"name": "77244", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/77244"}, {"name": "77246", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/77246"}, {"name": "46970", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/46970"}, {"name": "20111119 Freelancer calendar <= 1.01 SQL Injection Vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/520573/100/0/threaded"}, {"name": "18127", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "http://www.exploit-db.com/exploits/18127"}, {"name": "20111118 Freelancer calendar <= 1.01 SQL Injection Vulnerability", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://archives.neohapsis.com/archives/fulldisclosure/2011-11/0305.html"}, {"name": "50733", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/50733"}, {"name": "77247", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/77247"}, {"name": "77245", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/77245"}, {"name": "freelancer-searchfield-sql-injection(71403)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71403"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2011-5109", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple SQL injection vulnerabilities in Freelancer calendar 1.01 and earlier allow remote attackers to inject arbitrary web script or HTML via the SearchField parameter in a search action to (1) category_list.php, (2) Copy_of_calendar_list.php, (3) customer_statistics_list.php, (4) customer_list.php, and (5) task_statistics_list.php in the worldcalendar directory."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "77248", "refsource": "OSVDB", "url": "http://osvdb.org/77248"}, {"name": "77244", "refsource": "OSVDB", "url": "http://osvdb.org/77244"}, {"name": "77246", "refsource": "OSVDB", "url": "http://osvdb.org/77246"}, {"name": "46970", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/46970"}, {"name": "20111119 Freelancer calendar <= 1.01 SQL Injection Vulnerability", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/520573/100/0/threaded"}, {"name": "18127", "refsource": "EXPLOIT-DB", "url": "http://www.exploit-db.com/exploits/18127"}, {"name": "20111118 Freelancer calendar <= 1.01 SQL Injection Vulnerability", "refsource": "FULLDISC", "url": "http://archives.neohapsis.com/archives/fulldisclosure/2011-11/0305.html"}, {"name": "50733", "refsource": "BID", "url": "http://www.securityfocus.com/bid/50733"}, {"name": "77247", "refsource": "OSVDB", "url": "http://osvdb.org/77247"}, {"name": "77245", "refsource": "OSVDB", "url": "http://osvdb.org/77245"}, {"name": "freelancer-searchfield-sql-injection(71403)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71403"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T00:23:40.185Z"}, "title": "CVE Program Container", "references": [{"name": "77248", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/77248"}, {"name": "77244", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/77244"}, {"name": "77246", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/77246"}, {"name": "46970", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/46970"}, {"name": "20111119 Freelancer calendar <= 1.01 SQL Injection Vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/520573/100/0/threaded"}, {"name": "18127", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "http://www.exploit-db.com/exploits/18127"}, {"name": "20111118 Freelancer calendar <= 1.01 SQL Injection Vulnerability", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://archives.neohapsis.com/archives/fulldisclosure/2011-11/0305.html"}, {"name": "50733", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/50733"}, {"name": "77247", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/77247"}, {"name": "77245", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/77245"}, {"name": "freelancer-searchfield-sql-injection(71403)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71403"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2011-5109", "datePublished": "2012-08-23T20:00:00", "dateReserved": "2012-08-23T00:00:00", "dateUpdated": "2024-08-07T00:23:40.185Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:john_geo:freelancer_calendar:*:*:*:*:*:*:*:*", "matchCriteriaId": "122C7936-0547-4C6E-8B5C-4D2750B31EFF", "versionEndIncluding": "1.01", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in Freelancer calendar 1.01 and earlier allow remote attackers to inject arbitrary web script or HTML via the SearchField parameter in a search action to (1) category_list.php, (2) Copy_of_calendar_list.php, (3) customer_statistics_list.php, (4) customer_list.php, and (5) task_statistics_list.php in the worldcalendar directory."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de inyecci\u00f3n SQL en Freelancer Calendar v1.01 y anteriores permite a atacantes remotos inyectar c\u00f3digo web o html arbitrario a trav\u00e9s del par\u00e1metro SearchField en una acci\u00f3n de b\u00fasqueda de (1) category_list.php, (2) Copy_of_calendar_list.php, (3) customer_statistics_list.php, (4) customer_list.php, and (5) task_statistics_list.php en el directorio worldcalendar."}], "id": "CVE-2011-5109", "lastModified": "2024-11-21T01:33:39.460", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2012-08-23T20:55:02.483", "references": [{"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://archives.neohapsis.com/archives/fulldisclosure/2011-11/0305.html"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/77244"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/77245"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/77246"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/77247"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/77248"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/46970"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.exploit-db.com/exploits/18127"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/520573/100/0/threaded"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/50733"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71403"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://archives.neohapsis.com/archives/fulldisclosure/2011-11/0305.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/77244"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/77245"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/77246"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/77247"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/77248"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/46970"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.exploit-db.com/exploits/18127"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/520573/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/50733"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71403"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}