Description
PHP remote file inclusion vulnerability in cal_config.inc.php in Calendarix 0.7.20060401 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the calpath parameter. NOTE: this issue has been disputed by a third party, who says that the affected $calpath variable is set to a constant value in the beginning of the script. CVE concurs that the initial report is invalid
References
- 20060814 Calendarix <= 0.7 (calpath) Remote File Inclusion Vulnerability mailing-list
- calendarix-calconfig-file-include(28349) vdb-entry
- 20060815 Re: Calendarix <= 0.7 (calpath) Remote File Inclusion Vulnerability mailing-list
- 20060814 Re: Calendarix <= 0.7 (calpath) Remote File Inclusion Vulnerability mailing-list
- 1016694 vdb-entry
- 28284 vdb-entry
- 20060812 Calendarix <= 0.7 (calpath) Remote File Inclusion Vulnerability mailing-list
- 20060813 Re: Calendarix <= 0.7 (calpath) Remote File Inclusion Vulnerability mailing-list