PT-2006-1261 · Acal · Acal Calendar Project

Aliaksandr Hartsuyeu · Published 2006-01-12 · Updated 2018-10-19 · CVE-2006-0183

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ACal Calendar Project version 2.2.5

Description A direct static code injection issue allows authenticated users to execute arbitrary PHP code. This is achieved via the edit parameter, specifically through the edit=header value, which modifies header.php, or the edit=footer value, which modifies footer.php. The issue might be related to poor authentication.

Recommendations For ACal Calendar Project version 2.2.5, consider restricting access to the edit.php file to prevent authenticated users from modifying header.php and footer.php files until a proper fix is applied. As a temporary workaround, limit the ability of administrators to edit code directly to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-0183

Affected Products

Acal Calendar Project

References · 8

• http://evuln.com/vulns/25/summary.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0183 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24107 · Note
• http://securityreason.com/securityalert/343 · Note
• http://vupen.com/english/advisories/2006/0152 · Note
• http://osvdb.org/22345 · Note
• http://secunia.com/advisories/18432 · Note
• http://securityfocus.com/archive/1/421744/100/0/threaded · Note