CVE-2008-5840 PHP iCalendar 2.24 and earlier allows remote attackers to bypass authentication by setting the phpicalendar and phpicalendar_login cookies to 1.
HighCVSS 7.5
EPSS 3.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
PHP iCalendar 2.24 and earlier allows remote attackers to bypass authentication by setting the phpicalendar and phpicalendar_login cookies to 1.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phpicalendar | <= 2.24 | No fix listed |
| phpicalendar | = 0.7 | No fix listed |
| phpicalendar | = 0.8 | No fix listed |
| phpicalendar | = 0.9 | No fix listed |
| phpicalendar | = 0.9.5 | No fix listed |
| phpicalendar | = 1.0 | No fix listed |
| phpicalendar | = 1.1 | No fix listed |
| phpicalendar | = 2.0-beta | No fix listed |
| phpicalendar | = 2.0.1 | No fix listed |
| phpicalendar | = 2.0c | No fix listed |
| phpicalendar | = 2.1 | No fix listed |
| phpicalendar | = 2.2 | No fix listed |
| phpicalendar | = 2.21 | No fix listed |
| phpicalendar | = 2.22 | No fix listed |
| phpicalendar | = 2.23 | No fix listed |
| phpicalendar | = 2.23-rc1 | No fix listed |
| phpicalendar2.0 | = alpha_test | No fix listed |
References
- 4865 third-party-advisory
- 31320 exploit vdb-entry
- phpicalendar-index-authentication-bypass(45338) vdb-entry
- 6526 exploit