WebCalendar Alert!

Due to the following alert, the latest edge release of CPanel & Fantastico will NOT auto install WebCalendar. This version will be on our new server that is rolling out this weekend. If you wish to install WebCalendar, you will have to follow the instructions under "How do I" Boards

K-OTik Security Advisory : KOTIK/ADV-2005-0184
CVE Reference : GENERIC-MAP-NOMATCH
Rated as : Moderate
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2005-02-18

* Technical Description *

An SQL Injection vulnerability was reported in WebCalendar, wich may be exploited by attackers to execute arbitrary SQL commands. This flaw exists due to a missing input sanitising in "login" when used in cookies, which could be exploited to execute arbitrary SQL commands.

* Affected Products *

WebCalendar version 0.9.45 and earlier

* Solution *

WebCalendar version 0.9.5 :
http://www.k5n.us/webcalendar.php?topic=Download

* References *

http://www.k-otik.com/english/advisories/2005/0184
http://www.scovettalabs.com/advisory/SCL-2005.001.txt