Huy-Ngoc Dau

Multiple SQL vulnerabilities exist in various PHP files, including planning.php, user list.php, projets.php, user groupes.php, and groupe list.php.

The issue concerns multiple Cross-Site Scripting (XSS) vulnerabilities. These vulnerabilities allow malicious users to execute arbitrary code via the document.cookie in `nb mois` and `mb ligness` and the debug GET parameter to "export.php".

The issue allows remote attackers to obtain a calendar owner's password via a brute-force attack on the embedded password hash. This is because Soplanning generates static links for sharing ICAL calendars with embedded login information.

A directory traversal issue exists in the file get contents function, allowing remote attackers to determine the existence of arbitrary files by using a .. (dot dot) in a URL path parameter.

The issue allows remote authenticated users to execute arbitrary PHP code via a crafted database name, given certain conditions such as access to an existing database, permissions to create arbitrary databases, the use of PHP before version 5.2, a down configuration database, or a non-writable smarty/templates c directory.