Description
includes/functions.php in Craig Knudsen WebCalendar before 1.0.5 does not protect the noSet variable from external modification, which allows remote attackers to set arbitrary global variables via a URL with modified values in the noSet parameter, which leads to resultant vulnerabilities that probably include remote file inclusion and other issues.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | webcalendar | 0.9.45-4sarge6 | DSA-1267-1 |
Advisories 1
- DSA-1267-1 webcalendar - missing input sanitising Debian Security (DSA / DLA) · Mar 9, 2026
References
- ADV-2007-0851 vdb-entry
- http://webcalendar.cvs.sourceforge.net/webcalendar/webcalendar/includes/functions.php?view=log
- http://sourceforge.net/project/shownotes.php?group_id=3870&release_id=491130
- 24519 third-party-advisory
- 22834 vdb-entry
- DSA-1267 vendor-advisory
- http://webcalendar.cvs.sourceforge.net/webcalendar/webcalendar/includes/functions.php?r1=1.211.2.7&r2=1.211.2.8
- webcalendar-noset-variable-overwrite(32832) vdb-entry
- 24403 third-party-advisory
- [webcalendar-announce] 20070304 Announce: Release 1.0.5 (security patch) mailing-list