PT-2009-2205 · Unknown · Flat Calendar

Published 2009-04-21 · Updated 2018-10-11 · CVE-2008-6736

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Flat Calendar version 1.1

Description: The issue arises from improper access restrictions to administrative functions. This allows remote attackers to add new events via "calAdd.php" or delete events via "admin/deleteEvent.php". It is noted that this is only a vulnerability if the administrator does not follow the recommendations outlined in the product's security documentation.

Recommendations: For Flat Calendar version 1.1, ensure that administrators follow the security recommendations provided in the product's documentation to mitigate the risk of unauthorized access to administrative functions. As a temporary workaround, consider restricting access to "calAdd.php" and "admin/deleteEvent.php" until proper access controls are implemented.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-6736

Affected Products

Flat Calendar

References · 6

• 🔥 https://exploit-db.com/exploits/31908 · Exploit
• 🔥 http://osvdb.org/51506 · Exploit
• 🔥 http://securityfocus.com/bid/29662 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-6736 · Security Note
• http://securityfocus.com/archive/1/493278/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43039 · Note