PT-2008-6216 · Unknown · Mini Web Calendar

Ahmadbady · Published 2008-11-13 · Updated 2017-09-29 · CVE-2008-5062

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mini Web Calendar (mwcal) version 1.2

Description The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the php/cal pdf.php file. This is achieved by using directory traversal sequences in the thefile parameter.

Recommendations For Mini Web Calendar (mwcal) version 1.2, avoid using the thefile parameter in the php/cal pdf.php file until a fix is available. As a temporary workaround, consider restricting access to the php/cal pdf.php file to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-5062

Affected Products

Mini Web Calendar

References · 8

• 🔥 https://exploit-db.com/exploits/7049 · Exploit
• 🔥 http://securityfocus.com/bid/32196 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5062 · Security Note
• http://secunia.com/advisories/32640 · Vendor Advisory
• http://osvdb.org/49680 · Note
• http://securityreason.com/securityalert/4590 · Note
• http://vupen.com/english/advisories/2008/3077 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46455 · Note