CVE-2004-1423 Multiple PHP remote file inclusion vulnerabilities in Sean Proctor PHP-Calendar before 0.10.1, as used in Commonwealth of Massachusetts Virtual Law Office (VLO) and other products, allow remote attack...
HighCVSS 7.5
EPSS 15.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple PHP remote file inclusion vulnerabilities in Sean Proctor PHP-Calendar before 0.10.1, as used in Commonwealth of Massachusetts Virtual Law Office (VLO) and other products, allow remote attackers to execute arbitrary PHP code via a URL in the phpc_root_path parameter to (1) includes/calendar.php or (2) includes/setup.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| php-calendar | <= 0.10 | No fix listed |
| php-calendar | = 0.1 | No fix listed |
| php-calendar | = 0.2 | No fix listed |
| php-calendar | = 0.3 | No fix listed |
| php-calendar | = 0.4 | No fix listed |
| php-calendar | = 0.5 | No fix listed |
| php-calendar | = 0.6 | No fix listed |
| php-calendar | = 0.7 | No fix listed |
| php-calendar | = 0.8 | No fix listed |
| php-calendar | = 0.9 | No fix listed |
| php-calendar | = 0.9.1 | No fix listed |
References
- 20041229 php-Calendar File Include Vulnerability [ Command Exec ] mailing-list
- 22516 third-party-advisory
- 1017107 vdb-entry
- sourceforge.net
- www.gulftech.org exploit patch
- 20061021 Virtual Law Office (phpc_root_path) Remote File Include Vulnerability mailing-list
- 12127 exploit vdb-entry
- 20657 vdb-entry
- ADV-2006-4145 vdb-entry vendor-advisory
- php-calendar-file-include(18710) vdb-entry
- vlo-phpcrootpath-file-include(29710) vdb-entry
- 2608 exploit