|
|
Family: CGI abuses --> Category: attack
PHP iCalendar getdate Parameter Remote File Include Vulnerability Vulnerability Scan
Vulnerability Scan Summary
Checks for getdate parameter remote file include vulnerability in PHP iCalendar
Detailed Explanation for this Vulnerability Test
Synopsis :
The remote web server contains a PHP application that is susceptible
to remote file inclusion attacks.
Description :
The remote host appears to be running PHP iCalendar, a web-based iCal
file viewer / parser written in PHP.
The installed version of PHP iCalendar fails to validate user input to
the 'getdate' parameter of the 'search.php' script as well as the
'file' parameter of 'template.php' script. Provided PHP's
'register_globals' setting is enabled, an unauthenticated attacker can
leverage these flaws to view arbitrary files on the remote host and
execute arbitrary PHP code, possibly taken from third-party hosts.
See also :
http://evuln.com/vulns/70/summary.html
http://dimer.tamu.edu/phpicalendar.net/forums/viewtopic.php?p=1869#1869
Solution :
Disable PHP's 'register_globals' setting or modify the code as
described in the advisory above.
Threat Level:
Low / CVSS Base Score : 2.3
(AV:R/AC:L/Au:NR/C:N/I:P/A:N/B:N)
Click HERE for more information and discussions on this network vulnerability scan.
|
