LuxCal Web Calendar SQL Injection Vulnerability in pdf.php

A SQL injection vulnerability has been identified in the LuxCal Web Calendar versions prior to 5.3.3M (MySQL) and prior to 5.3.3L (SQLite). The vulnerability resides in the pdf.php file, where improper handling of external input allows attackers to manipulate SQL queries. Exploitation of this vulnerability could lead to unauthorized deletion, modification, or retrieval of database information.

Impact

Exploitation of this vulnerability could result in unauthorized deletion, alteration, or retrieval of database information.

Remediation

Users are advised to update LuxCal Web Calendar to version 5.3.3 or later. The latest version can be downloaded from the LuxCal website.