CVE-2006-0610
Description
Multiple SQL injection vulnerabilities in 2200net Calendar system 1.2, with gpc_magic_quotes disabled, allow remote attackers to execute arbitrary SQL commands and bypass authentication via (1) the fm_data[id] parameter to calendar.php and (2) the $ad['acc'] variable in adminlogin.php.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Patches
Vulnerability mechanics
Root cause
"Missing input sanitization in SQL query construction allows arbitrary SQL injection."
Attack vector
An attacker can send a crafted HTTP request to `calendar.php` with a malicious `fm_data[id]` parameter containing SQL metacharacters to execute arbitrary SQL commands. For authentication bypass, the attacker submits a login request to `admin.php?ad=login` with a username value such as `' or 1/*` and any password, which injects into the `$ad['acc']` variable and subverts the authentication query. Both attacks require `magic_quotes_gpc` to be disabled [ref_id=1][ref_id=2].
Affected code
The SQL injection occurs in `program/calendar/calendar.php` via the `fm_data[id]` parameter, and the authentication bypass is in `class/classlogin/adminlogin.php` via the `$ad['acc']` variable. Both scripts fail to sanitize user-supplied input before constructing SQL queries [ref_id=1][ref_id=2].
What the fix does
No patch is available from the vendor. The advisory states the developer(s) did not reply and no solution has been released [ref_id=1][ref_id=2]. To remediate, the application must properly escape or parameterize the `fm_data[id]` and `$ad['acc']` variables before including them in SQL queries, or enable `magic_quotes_gpc` as a partial mitigation.
Preconditions
- configmagic_quotes_gpc must be disabled
- networkAttacker must be able to send HTTP requests to the vulnerable scripts
Generated on Jun 17, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
10- www.evuln.com/vulns/62/summary.htmlnvdVendor Advisory
- marc.infonvd
- secunia.com/advisories/18781nvd
- www.osvdb.org/23037nvd
- www.osvdb.org/23038nvd
- www.securityfocus.com/archive/1/425094/100/0/threadednvd
- www.securityfocus.com/bid/16569nvd
- www.vupen.com/english/advisories/2006/0486nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/24483nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/24484nvd
News mentions
0No linked articles in our index yet.