PT-2010-2164 · Jce Tech · Jce-Tech Php Calendars

Lionturk · Published 2010-01-22 · Updated 2010-01-25 · CVE-2010-0380

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions JCE-Tech PHP Calendars version downloaded 20100121

Description The issue allows remote attackers to bypass intended access restrictions and modify application settings via a direct request to "install.php". This is only considered a problem when the administrator does not follow the recommendations outlined in the product's installation documentation.

Recommendations For the version downloaded 20100121, follow the installation documentation recommendations to prevent exploitation. As a temporary workaround, consider restricting access to the "install.php" file until the issue is properly addressed by following the documentation guidelines.

Exploit

Fix

Weakness Enumeration

CWE-264

CWE-16

Related Identifiers

CVE-2010-0380

Affected Products

Jce-Tech Php Calendars

References · 4

• 🔥 https://exploit-db.com/exploits/11082 · Exploit
• 🔥 http://exploit-db.com/exploits/11082 · Exploit
• 🔥 http://packetstormsecurity.org/1001-exploits/phpcalendars-xss.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-0380 · Security Note