Description
login.php in ACal Calendar Project 2.2.5 allows remote attackers to bypass authentication by setting the ACalAuthenticate cookie variable to "inside".
References
- 343 third-party-advisory
- http://evuln.com/vulns/25/summary.html
- ADV-2006-0152 vdb-entry
- 18432 third-party-advisory
- acal-login-auth-bypass(24104) vdb-entry
- 20060112 [eVuln] ACal Authentication Bypass & PHP Code Insertion mailing-list
- 22344 vdb-entry