PT-2006-4550 · Softcomplex · Softcomplex Php Event Calendar

Published 2006-07-18 · Updated 2018-10-18 · CVE-2006-3684

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SoftComplex PHP Event Calendar version 1.4

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the path to calendar parameter. This occurs because the path to calendar parameter overwrites the $path to calendar variable from an extract function call, enabling the execution of malicious code.

Recommendations For SoftComplex PHP Event Calendar version 1.4, consider restricting access to the calendar.php file or validating and sanitizing the path to calendar parameter to prevent the execution of arbitrary PHP code. As a temporary workaround, avoid using the path to calendar parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-3684

Affected Products

Softcomplex Php Event Calendar

References · 8

• 🔥 http://securityfocus.com/bid/18965 · Exploit
• http://secunia.com/advisories/21074 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3684 · Security Note
• http://secunia.com/advisories/21417 · Vendor Advisory
• http://vupen.com/english/advisories/2006/2848 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27766 · Note
• http://securityfocus.com/archive/1/440265/100/0/threaded · Note
• http://solpotcrew.org/adv/solpot-adv-01.txt · Note