PT-2005-4357 · Php · Php Icalendar+4

Robin Verton · Published 2005-11-16 · Updated 2016-10-18 · CVE-2005-3571

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHPCalendar version 1.0 PHPClique version 1.0 PHPCurrently version 2.0 PHPFanBase versions 2.1 through 2.2 PHPQuotes version 1.0

Description The issue allows remote attackers to include arbitrary local files via the siteurl parameter when register globals is enabled.

Recommendations For PHPCalendar version 1.0, consider disabling the siteurl parameter until a patch is available. For PHPClique version 1.0, restrict access to the vulnerable module to minimize the risk of exploitation. For PHPCurrently version 2.0, avoid using the siteurl parameter in the affected API endpoint until the issue is resolved. For PHPFanBase versions 2.1 through 2.2, as a temporary workaround, consider disabling the functionality that uses the siteurl parameter. For PHPQuotes version 1.0, restrict the use of the siteurl parameter to prevent arbitrary file inclusion.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2005-3571

Affected Products

Php Icalendar

Phpclique

Phpcurrently

Phpfanbase

Phpquotes

References · 9

• 🔥 https://exploit-db.com/exploits/26505 · Exploit
• http://secunia.com/advisories/17542 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3571 · Security Note
• http://vupen.com/english/advisories/2005/2402 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=113199214723444&w=2 · Note
• http://securityfocus.com/bid/15417 · Note
• http://securityreason.com/securityalert/176 · Note
• http://securityfocus.com/bid/21664 · Note
• http://securitytracker.com/id?1015206 · Note