CVE-2011-5109

HIGH 7.5CVE-2011-5109 · Published 23/08/2012 · updated 16/06/2026

In short

CVE-2011-5109 is a HIGH (CVSS 7.5) vulnerability affecting freelancer calendar (john geo).
Chance of exploitation in the next 30 days (EPSS): 2.0%, higher than 81.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
freelancer calendar john_geo	`≤ 1.01`	No fix yet

Description

Multiple SQL injection vulnerabilities in Freelancer calendar 1.01 and earlier allow remote attackers to inject arbitrary web script or HTML via the SearchField parameter in a search action to (1) category_list.php, (2) Copy_of_calendar_list.php, (3) customer_statistics_list.php, (4) customer_list.php, and (5) task_statistics_list.php in the worldcalendar directory.

References

archives.neohapsis.com/archives/fulldisclosure/2011-11/0305.html · Exploit
osvdb.org/77244
osvdb.org/77245
osvdb.org/77246
osvdb.org/77247
osvdb.org/77248
secunia.com/advisories/46970 · Vendor Advisory
exploit-db.com/exploits/18127 · Exploit
securityfocus.com/archive/1/520573/100/0/threaded
securityfocus.com/bid/50733 · Exploit
exchange.xforce.ibmcloud.com/vulnerabilities/71403

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free