PT-2006-4550 · Softcomplex · Softcomplex Php Event Calendar

Publicado 2006-07-18 · Atualizado 2018-10-18 · CVE-2006-3684

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SoftComplex PHP Event Calendar version 1.4

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the path to calendar parameter. This occurs because the path to calendar parameter overwrites the $path to calendar variable from an extract function call, enabling the execution of malicious code.

Recommendations For SoftComplex PHP Event Calendar version 1.4, consider restricting access to the calendar.php file or validating and sanitizing the path to calendar parameter to prevent the execution of arbitrary PHP code. As a temporary workaround, avoid using the path to calendar parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-3684

Produtos afetados

Softcomplex Php Event Calendar

Referências · 8

• 🔥 http://securityfocus.com/bid/18965 · Exploit
• http://vupen.com/english/advisories/2006/2848 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27766 · Nota
• http://securityfocus.com/archive/1/440265/100/0/threaded · Nota
• http://secunia.com/advisories/21074 · Aviso do Fabricante
• http://solpotcrew.org/adv/solpot-adv-01.txt · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3684 · Nota de Segurança
• http://secunia.com/advisories/21417 · Aviso do Fabricante