PT-2004-2338 · Php · Php Icalendar

Publicado 2004-12-31 · Atualizado 2018-10-19 · CVE-2004-1423

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: PHP-Calendar versions prior to 0.10.1

Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the phpc root path parameter to specific PHP files, such as includes/calendar.php or includes/setup.php.

Recommendations: For versions prior to 0.10.1, update to version 0.10.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the includes/calendar.php and includes/setup.php files to minimize the risk of exploitation. Avoid using the phpc root path parameter in these files until the issue is resolved.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2004-1423

Produtos afetados

Php Icalendar

Referências · 14

• 🔥 http://gulftech.org/?node=research&article_id=00060-12292004 · Exploit
• 🔥 http://securityfocus.com/bid/12127 · Exploit
• 🔥 https://exploit-db.com/exploits/2608 · Exploit
• 🔥 https://exploit-db.com/exploits/43819 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18710 · Nota
• http://sourceforge.net/project/shownotes.php?release_id=296020&group_id=46800 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29710 · Nota
• http://marc.info/?l=bugtraq&m=110434580716205&w=2 · Nota
• http://securitytracker.com/id?1017107 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-1423 · Nota de Segurança
• http://vupen.com/english/advisories/2006/4145 · Aviso do Fabricante
• http://securityfocus.com/archive/1/449397/100/0/threaded · Nota
• http://secunia.com/advisories/22516 · Nota
• http://securityfocus.com/bid/20657 · Nota