Description
PHP file inclusion vulnerability in index.php in PHP iCalendar 2.0a2 through 2.0.1 allows remote attackers to execute arbitrary PHP code and include arbitrary local files via the phpicalendar cookie. NOTE: this is not a cross-site scripting (XSS) issue as claimed by the original researcher.
References
- http://www.ush.it/2005/10/25/php-icalendar-css/
- ADV-2005-2204 vdb-entry
- 113 third-party-advisory
- phpicalendar-index-file-include(22864) vdb-entry
- 20051025 PHP iCalendar CSS mailing-list
- 15193 vdb-entry
- 17328 third-party-advisory
- 1015102 vdb-entry
- 20051025 PHP iCalendar CSS mailing-list