PT-2004-2338 · Php · Php Icalendar

Published 2004-12-31 · Updated 2018-10-19 · CVE-2004-1423

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: PHP-Calendar versions prior to 0.10.1

Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the phpc root path parameter to specific PHP files, such as includes/calendar.php or includes/setup.php.

Recommendations: For versions prior to 0.10.1, update to version 0.10.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the includes/calendar.php and includes/setup.php files to minimize the risk of exploitation. Avoid using the phpc root path parameter in these files until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2004-1423

Affected Products

Php Icalendar

References · 14

• 🔥 http://gulftech.org/?node=research&article_id=00060-12292004 · Exploit
• 🔥 http://securityfocus.com/bid/12127 · Exploit
• 🔥 https://exploit-db.com/exploits/2608 · Exploit
• 🔥 https://exploit-db.com/exploits/43819 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1423 · Security Note
• http://vupen.com/english/advisories/2006/4145 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18710 · Note
• http://sourceforge.net/project/shownotes.php?release_id=296020&group_id=46800 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29710 · Note
• http://marc.info/?l=bugtraq&m=110434580716205&w=2 · Note
• http://securitytracker.com/id?1017107 · Note
• http://securityfocus.com/archive/1/449397/100/0/threaded · Note
• http://secunia.com/advisories/22516 · Note
• http://securityfocus.com/bid/20657 · Note