PT-2006-1261 · Acal · Acal Calendar Project

Aliaksandr Hartsuyeu · Publicado 2006-01-12 · Atualizado 2018-10-19 · CVE-2006-0183

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ACal Calendar Project version 2.2.5

Description A direct static code injection issue allows authenticated users to execute arbitrary PHP code. This is achieved via the edit parameter, specifically through the edit=header value, which modifies header.php, or the edit=footer value, which modifies footer.php. The issue might be related to poor authentication.

Recommendations For ACal Calendar Project version 2.2.5, consider restricting access to the edit.php file to prevent authenticated users from modifying header.php and footer.php files until a proper fix is applied. As a temporary workaround, limit the ability of administrators to edit code directly to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-0183

Produtos afetados

Acal Calendar Project

Referências · 8

• https://exchange.xforce.ibmcloud.com/vulnerabilities/24107 · Nota
• http://securityreason.com/securityalert/343 · Nota
• http://vupen.com/english/advisories/2006/0152 · Nota
• http://evuln.com/vulns/25/summary.html · Aviso do Fabricante
• http://osvdb.org/22345 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0183 · Nota de Segurança
• http://secunia.com/advisories/18432 · Nota
• http://securityfocus.com/archive/1/421744/100/0/threaded · Nota