PT-2006-7421 · Php · Php Icalendar

Lostmon

·

Publicado

2006-12-29

·

Atualizado

2018-10-17

·

CVE-2006-6824

CVSS v2.0

4.3

Média

VetorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions: PHP iCalendar versions 2.23 rc1 and earlier PHP iCalendar version 2.24 (vectors b, c, and d)
Description: The issue allows remote attackers to inject arbitrary web script or HTML via several parameters in various PHP files. The affected parameters include getdate in multiple files, cpath in several files, query in search.php, and possibly cpath, unset, and set parameters in a setcookie action in preferences.php.
Recommendations: For PHP iCalendar versions 2.23 rc1 and earlier, consider disabling the affected parameters, such as getdate and cpath, in the respective PHP files until a patch is available. For PHP iCalendar version 2.24, restrict access to vectors b, c, and d, which are affected by the issue, until a fix is provided. As a temporary workaround, avoid using the query parameter in search.php and the cpath, unset, and set parameters in preferences.php until the issue is resolved.

Exploit

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2006-6824

Produtos afetados

Php Icalendar