php iCalendar Local File Include Vulnerability

Bugtraq ID:	17125
Class:	Input Validation Error
CVE:	CVE-2006-1292 CVE-2008-5968
Remote:	Yes
Local:	No
Published:	Mar 15 2006 12:00AM
Updated:	Feb 09 2009 05:58PM
Credit:	rgod is credited with the discovery of this vulnerability.
Vulnerable:	PHP iCalendar PHP iCalendar 2.2.1 PHP iCalendar PHP iCalendar 2.0.1 PHP iCalendar PHP iCalendar 2.0 c PHP iCalendar PHP iCalendar 2.0 b PHP iCalendar PHP iCalendar 2.0 a2 PHP iCalendar PHP iCalendar 2.24 PHP iCalendar PHP iCalendar 2.23 rc1 PHP iCalendar PHP iCalendar 2.22 PHP iCalendar PHP iCalendar 2.22 PHP iCalendar PHP iCalendar 2.1 PHP iCalendar PHP iCalendar 2.0
Not Vulnerable:

php iCalendar Local File Include Vulnerability

PHP iCalendar is prone to a local file-include vulnerability. This may facilitate the unauthorized viewing of files and unauthorized execution of local scripts.

PHP iCalendar 2.21 and prior versions are vulnerable; other versions may be affected as well.

php iCalendar Local File Include Vulnerability

Example exploit code has been supplied:

• /data/vulnerabilities/exploits/17125.html
• /data/vulnerabilities/exploits/php_ical.html

php iCalendar Local File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

php iCalendar Local File Include Vulnerability

References:

• Exploit for PHP iCalendar <= 2.2.1 (rgod)
  
• PHP iCalendar Homepage (PHP iCalendar)