PT-2006-1704 · Php · Php Icalendar

Aliaksandr Hartsuyeu · Published 2006-02-13 · Updated 2018-10-19 · CVE-2006-0648

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP iCalendar versions 2.0.1 through 2.2

Description The issue allows remote attackers to include arbitrary files, potentially leading to security breaches. This is achieved through directory traversal vulnerabilities, specifically via the getdate parameter and possibly other parameters in the replace files function in search.php, as well as the $file variable in the parse function in functions/template.php.

Recommendations For PHP iCalendar versions 2.0.1 through 2.2, consider restricting access to the replace files function in search.php and the parse function in functions/template.php to minimize the risk of exploitation. Avoid using the getdate parameter and the $file variable in the affected functions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-0648

Affected Products

Php Icalendar

References · 9

• 🔥 http://evuln.com/vulns/70/summary.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-0648 · Security Note
• http://secunia.com/advisories/18778 · Vendor Advisory
• http://securityfocus.com/archive/1/424424/100/0/threaded · Note
• http://phpicalendar.net/forums/viewtopic.php?t=396 · Note
• http://vupen.com/english/advisories/2006/0493 · Note
• http://securityreason.com/securityalert/420 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24591 · Note
• http://securityfocus.com/bid/16557 · Note