|
|
Family: CGI abuses --> Category: infos
PHP-Calendar Remote File Include Vulnerability Vulnerability Scan
Vulnerability Scan Summary
Acertains if PHP-Calendar can include third-party files
Detailed Explanation for this Vulnerability Test
Synopsis :
The remote web server contains a PHP script that is affected by a
remote file include vulnerability.
Description :
The remote web server is running PHP-Calendar, a web-based calendar
written in PHP.
The remote version of this software is vulnerable to a file inclusion
flaw which may allow a possible hacker to execute arbitrary PHP commands on
the remote host.
See also :
http://www.gulftech.org/?node=research&article_id=00060-12292004
http://archives.neohapsis.com/archives/bugtraq/2004-12/0441.html
http://sourceforge.net/project/shownotes.php?release_id=296020&group_id=46800
Solution :
Upgrade to PHP-Calendar version 0.10.1 or later.
Threat Level:
High / CVSS Base Score : 7
(AV:R/AC:L/Au:NR/C:P/A:P/I:P/B:N)
Click HERE for more information and discussions on this network vulnerability scan.
|
