CVE-2023-46700
📋 TL;DR
This is a critical SQL injection vulnerability in LuxCal Web Calendar that allows remote unauthenticated attackers to execute arbitrary SQL commands. Attackers can read, modify, or delete database contents, potentially gaining full control of affected systems. All users running vulnerable versions of LuxCal Web Calendar are affected.
💻 Affected Systems
- LuxCal Web Calendar
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, authentication bypass, and potential remote code execution through database functions.
Likely Case
Unauthorized access to sensitive calendar data, user information extraction, and potential privilege escalation.
If Mitigated
Limited impact if proper input validation and WAF rules are in place, though SQL injection remains dangerous even with mitigations.
🎯 Exploit Status
SQL injection vulnerabilities are commonly weaponized. The unauthenticated nature and high CVSS score make this attractive to attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.2.4M for MySQL, 5.2.4L for SQLite
Vendor Advisory: https://www.luxsoft.eu/lcforum/viewtopic.php?id=476
Restart Required: Yes
Instructions:
1. Backup your database and configuration. 2. Download the patched version from luxsoft.eu. 3. Replace vulnerable files with patched version. 4. Restart web server. 5. Verify functionality.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns
Input Validation
allImplement strict input validation on all user inputs
🧯 If You Can't Patch
- Isolate the LuxCal instance behind a reverse proxy with strict WAF rules
- Restrict network access to only trusted IP addresses
🔍 How to Verify
Check if Vulnerable:
Check LuxCal version in admin panel or by examining version.php file. Compare against vulnerable versions.Check Version:
Check admin panel or view source of login page for version informationVerify Fix Applied:
Confirm version is 5.2.4M (MySQL) or 5.2.4L (SQLite) or later. Test SQL injection attempts should be blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in web logs
- Multiple failed login attempts with SQL syntax
- Unexpected database queries
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, etc.)
- Requests to calendar endpoints with unusual parameters
SIEM Query:
web_logs WHERE (url CONTAINS 'luxcal' AND (message CONTAINS 'sql' OR message CONTAINS 'syntax' OR parameters CONTAINS 'union' OR parameters CONTAINS 'select'))