Php · Myphpcalendar · CVE-2006-6812
Name of the Vulnerable Software and Affected Versions:
myPHPCalendar version 10.1
Description:
The issue allows remote attackers to execute arbitrary PHP code via a URL in the `cal dir` parameter to API endpoints such as "admin.php", "contacts.php", or "convert-date.php".
Recommendations:
For myPHPCalendar version 10.1, consider restricting access to the "admin.php", "contacts.php", and "convert-date.php" API endpoints to minimize the risk of exploitation. Avoid using the `cal dir` parameter in these endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.