Description
Multiple PHP remote file inclusion vulnerabilities in myWebland myEvent 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the myevent_path parameter in (1) event.php and (2) initialize.php. NOTE: vector 2 was later reported to affect 1.4 as well.
References
- 17575 vdb-entry
- 19680 third-party-advisory
- 767 third-party-advisory
- 1016616 vdb-entry
- 726 third-party-advisory
- 20060416 MyEvent Remote File Execution And XSS Attacking mailing-list
- myevent-myevent-file-include(28347) vdb-entry
- 24722 vdb-entry
- myevent-event-initialize-file-include(25882) vdb-entry
- ADV-2006-1384 vdb-entry
- 24723 vdb-entry