LuxCal Web Calendar SQL Injection Vulnerability in retrieve.php

A SQL injection vulnerability has been identified in the LuxCal Web Calendar, affecting versions prior to 5.3.3M (MySQL) and prior to 5.3.3L (SQLite). The vulnerability resides in retrieve.php, where unsanitized input is directly embedded into SQL statements, allowing attackers to manipulate database queries. Exploitation of this vulnerability could lead to unauthorized deletion, modification, or retrieval of database information.

Impact

Exploitation of this vulnerability could result in unauthorized deletion, alteration, or retrieval of database information.

Remediation

Users are advised to update LuxCal Web Calendar to version 5.3.3 or later. The latest version can be downloaded from the LuxSoft website.