CVE-2007-1483 Multiple PHP remote file inclusion vulnerabilities in WebCalendar 0.9.45 allow remote attackers to execute arbitrary PHP code via a URL in the includedir parameter to (1) login.php, (2) get_reminders....
HighCVSS 7.5
EPSS 4.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple PHP remote file inclusion vulnerabilities in WebCalendar 0.9.45 allow remote attackers to execute arbitrary PHP code via a URL in the includedir parameter to (1) login.php, (2) get_reminders.php, or (3) get_events.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| k5n webcalendar | = 0.9.45 | No fix listed |
References
- 2425 exploit third-party-advisory
- [webcalendar-announce] 20070304 Announce: Release 1.0.5 (security patch) mailing-list
- 20070315 WebCalendar v0.9.45 (13 Dec 2004) (login.php) Remote File include mailing-list
- 20070320 Re: WebCalendar v0.9.45 (13 Dec 2004) (login.php) Remote File include mailing-list
- 23054 exploit patch vdb-entry
- webcalendar-multiple-file-include(33008) vdb-entry
- 3492 exploit