Secunia

Two vulnerabilities and a weakness have been reported in WebCalendar, which can be exploited by malicious users to conduct SQL injection attacks, and by malicious people to gain knowledge of certain information and conduct HTTP response splitting attacks.

1) Input passed to the "time_range" parameter in "edit_report_handler.php" isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

2) Input passed to the "ret" parameter in "layers_toggle.php" isn't properly sanitised before being returned to the user. This can be exploited to inject arbitrary HTTP headers, which will be included in the response sent to the user.

The vulnerability has been reported in versions 1.0.1 and 1.1.0 (development). Other versions may also be affected.

3) An error caused due to the application changing the color scheme if the supplied username is valid when attempting to login, can be exploited to enumerate valid usernames.

Solution
Update to version 1.0.2.
Further details available in Customer Area

Provided and/or discovered by
1-2) lwang
3) core24

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area