CVE-2005-3366 - PHP file inclusion vulnerability in index.php in PHP iCalendar 2.0a2 through 2.0.1 allows remote att

CVE-2005-3366

Summary

PHP file inclusion vulnerability in index.php in PHP iCalendar 2.0a2 through 2.0.1 allows remote attackers to execute arbitrary PHP code and include arbitrary local files via the phpicalendar cookie. NOTE: this is not a cross-site scripting (XSS) issue as claimed by the original researcher.

References

Vulnerable Configurations

cpe:2.3:a:php_icalendar:php_icalendar:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:php_icalendar:php_icalendar:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:php_icalendar:php_icalendar:2.0a2:*:*:*:*:*:*:*
cpe:2.3:a:php_icalendar:php_icalendar:2.0a2:*:*:*:*:*:*:*
cpe:2.3:a:php_icalendar:php_icalendar:2.0b:*:*:*:*:*:*:*
cpe:2.3:a:php_icalendar:php_icalendar:2.0b:*:*:*:*:*:*:*
cpe:2.3:a:php_icalendar:php_icalendar:2.0c:*:*:*:*:*:*:*
cpe:2.3:a:php_icalendar:php_icalendar:2.0c:*:*:*:*:*:*:*

CVSS

Base:	6.8 (as of 11-07-2017 - 01:33)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:P

refmap via4

bid	15193
bugtraq	20051025 PHP iCalendar CSS
fulldisc	20051025 PHP iCalendar CSS
misc	http://www.ush.it/2005/10/25/php-icalendar-css/
sectrack	1015102
secunia	17328
sreason	113
vupen	ADV-2005-2204
xf	phpicalendar-index-file-include(22864)

Last major update

11-07-2017 - 01:33

Published

30-10-2005 - 14:34

Last modified

11-07-2017 - 01:33