aspWebCalendar 'calendar_admin.asp' Arbitrary File Upload Vulnerability

Bugtraq ID:	29795
Class:	Input Validation Error
CVE:	CVE-2008-2832
Remote:	Yes
Local:	No
Published:	Jun 18 2008 12:00AM
Updated:	May 07 2015 05:28PM
Credit:	Alemin_Krali
Vulnerable:	Full Revolution aspWebCalendar 4.5.3 Full Revolution aspWebCalendar 4.5.2 Full Revolution aspWebCalendar 4.5.1 Full Revolution aspWebCalendar 4.5
Not Vulnerable:	Full Revolution aspWebCalendar 4.5.3c

aspWebCalendar 'calendar_admin.asp' Arbitrary File Upload Vulnerability

aspWebCalendar is prone to a vulnerability that lets remote attackers upload and execute arbitrary script code on an affected computer with the privileges of the webserver process. The issue occurs because the application fails to sanitize user-supplied input.

Versions prior to aspWebCalendar 4.5.3c are vulnerable.

aspWebCalendar 'calendar_admin.asp' Arbitrary File Upload Vulnerability

Attackers may exploit this issue through a browser.

The following proof of concept is available:

• /data/vulnerabilities/exploits/29795.html

aspWebCalendar 'calendar_admin.asp' Arbitrary File Upload Vulnerability

Solution:
The vendor has released an update. Please contact the vendor for details.

aspWebCalendar 'calendar_admin.asp' Arbitrary File Upload Vulnerability

References:

• Full Revolution Homepage (Full Revolution)