Executive brief
LuxCal is a calendar management application used to organize and share events. A SQL injection vulnerability in the RSS feed functionality allows unauthenticated attackers to extract sensitive data from the database, including user passwords and other confidential information by crafting malicious web requests.
Technical details
The vulnerability is a SQL injection flaw in rssfeed.php and common/retrieve.php caused by insufficient input validation on the 'cU' parameter. The application uses a weak regex-based filter that replaces only digits with placeholders, leaving SQL metacharacters intact. An attacker can bypass this filter by injecting UNION SELECT statements to extract arbitrary data from the database. The attack requires network access to the rssfeed.php endpoint and no authentication is required. A working proof-of-concept demonstrates extraction of user password hashes from the users table.
Affected products
- LuxSoft LuxCal through 5.3.4L
Timeline
- 2026-09-13: disclosed