PT-2026-83076 · Unknown · Dp Calendar
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
DP Calendar versions 5.5.0 through 10.11.2
Description
An authenticated and privileged blind SQL injection exists within the content plugin. This issue occurs when saving an article, provided the user has update permissions for articles. Blind SQL injection is a technique where an attacker asks the database true or false questions and determines the answer based on the application's response.
Recommendations
Update DP Calendar to a version later than 10.11.2.
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Dp Calendar