CVE-2008-6736 Flat Calendar 1.1 does not properly restrict access to administrative functions, which allows remote attackers to (1) add new events via calAdd.php, as reachable from admin/add.php, or (2) delete even...
MediumCVSS 6.4
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Flat Calendar 1.1 does not properly restrict access to administrative functions, which allows remote attackers to (1) add new events via calAdd.php, as reachable from admin/add.php, or (2) delete events via admin/deleteEvent.php. NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product's security documentation.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| circulargenius flat calendar | = 1.1 | No fix listed |
References
- 51506 exploit vdb-entry
- 20080611 Flat Calendar v1.1 Remote Permission Bypass Vulnerability mailing-list
- 29662 exploit vdb-entry
- flatcalendar-add-deleteevent-security-bypass(43039) vdb-entry