Light Weight Calendar Cal.PHP Remote Command Execution Vulnerability
BID:17059
Info
Light Weight Calendar Cal.PHP Remote Command Execution Vulnerability
| Bugtraq ID: | 17059 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 09 2006 12:00AM |
| Updated: | Mar 20 2006 10:24PM |
| Credit: | Hessam-x is credited with the discovery of this vulnerability. |
| Vulnerable: |
Light Weight Calendar Light Weight Calendar 1.0 |
| Not Vulnerable: | |
Discussion
Light Weight Calendar Cal.PHP Remote Command Execution Vulnerability
Light Weight Calendar is prone to a remote command-execution vulnerability. This is due to a lack of proper sanitization of user-supplied input.
An attacker can exploit this issue to execute arbitrary remote PHP commands on an affected computer with the privileges of the webserver process.
Successful exploitation could facilitate unauthorized access; other attacks are also possible.
Light Weight Calendar is prone to a remote command-execution vulnerability. This is due to a lack of proper sanitization of user-supplied input.
An attacker can exploit this issue to execute arbitrary remote PHP commands on an affected computer with the privileges of the webserver process.
Successful exploitation could facilitate unauthorized access; other attacks are also possible.
Exploit / POC
Light Weight Calendar Cal.PHP Remote Command Execution Vulnerability
An exploit is not required.
An example exploit has been provided:
An exploit is not required.
An example exploit has been provided:
Solution / Fix
Light Weight Calendar Cal.PHP Remote Command Execution Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
References
Light Weight Calendar Cal.PHP Remote Command Execution Vulnerability
References:
References:
- DreamAccount Exploit (Drago84)
- Dreamcost.com Web Site (DreamAccount )