Vulnerability Scanning Solutions, LLC.
Our Process
What We Scan For
Sample Report
Client List
Contact Us
What We Scan For
Family: CGI abuses --> Category: attack

PHP iCalendar getdate Parameter Remote File Include Vulnerability Vulnerability Scan

Vulnerability Scan Summary
Checks for getdate parameter remote file include vulnerability in PHP iCalendar

Detailed Explanation for this Vulnerability Test

Synopsis :

The remote web server contains a PHP application that is susceptible
to remote file inclusion attacks.

Description :

The remote host appears to be running PHP iCalendar, a web-based iCal
file viewer / parser written in PHP.

The installed version of PHP iCalendar fails to validate user input to
the 'getdate' parameter of the 'search.php' script as well as the
'file' parameter of 'template.php' script. Provided PHP's
'register_globals' setting is enabled, an unauthenticated attacker can
leverage these flaws to view arbitrary files on the remote host and
execute arbitrary PHP code, possibly taken from third-party hosts.

See also :

Solution :

Disable PHP's 'register_globals' setting or modify the code as
described in the advisory above.

Threat Level:

Low / CVSS Base Score : 2.3

Click HERE for more information and discussions on this network vulnerability scan.


P.O. Box 827051

Pembroke Pines, FL 33082-7051

Vulnerability Scanning Solutions, LLC.