RETIRED:ExtCalendar For Mambo ExtCalendar.php Remote File Include Vulnerability
BID:19042
CVE-2006-3556 |Info
RETIRED:ExtCalendar For Mambo ExtCalendar.php Remote File Include Vulnerability
| Bugtraq ID: | 19042 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 18 2006 12:00AM |
| Updated: | Aug 17 2006 04:50PM |
| Credit: | saudihackrz is credited with the discovery of this vulnerability. |
| Vulnerable: |
MamboXChange EXTCalendar 0.9.1 MamboXChange EXTCalendar 2.0 |
| Not Vulnerable: |
MamboXChange EXTCalendar 0.9.2 |
Discussion
RETIRED:ExtCalendar For Mambo ExtCalendar.php Remote File Include Vulnerability
ExtCalendar for Mambo is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.
Versions 2.0 and prior are vulnerable to this issue.
This BID is being retired because it is a duplicate of BID 18876 (ExtCalendar ExtCalendar.php Remote File Include Vulnerability).
ExtCalendar for Mambo is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.
Versions 2.0 and prior are vulnerable to this issue.
This BID is being retired because it is a duplicate of BID 18876 (ExtCalendar ExtCalendar.php Remote File Include Vulnerability).
Exploit / POC
RETIRED:ExtCalendar For Mambo ExtCalendar.php Remote File Include Vulnerability
Attackers can exploit this issue via a web client.
The following proof-of-concept URI is available:
Attackers can exploit this issue via a web client.
The following proof-of-concept URI is available:
Solution / Fix
RETIRED:ExtCalendar For Mambo ExtCalendar.php Remote File Include Vulnerability
Solution:
The vendor has released version 0.9.2 to address this issue. Please refer to the vendor's home page for more information.
MamboXChange EXTCalendar 2.0
MamboXChange EXTCalendar 0.9.1
Solution:
The vendor has released version 0.9.2 to address this issue. Please refer to the vendor's home page for more information.
MamboXChange EXTCalendar 2.0
-
MamboXChange com_extcalremoval-RC1.zip
http://mamboguru.com/downloads/ExtCalendar/com_extcalremoval-RC1.zip
MamboXChange EXTCalendar 0.9.1
-
MamboXChange com_extcalremoval-RC1.zip
http://mamboguru.com/downloads/ExtCalendar/com_extcalremoval-RC1.zip
References
RETIRED:ExtCalendar For Mambo ExtCalendar.php Remote File Include Vulnerability
References:
References:
- MamboXChange ExtCalendar Home Page (MamboXChange)