CVE-2006-1291 - publish.ical.php in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier does not require authentic

CVE-2006-1291

Summary

publish.ical.php in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier does not require authentication for write access to the calendars directory, which allows remote attackers to upload and execute arbitrary PHP scripts via a WebDAV PUT request with a filename containing a .php extension and a trailing null character.

References

Vulnerable Configurations

cpe:2.3:a:php_icalendar:php_icalendar:2.0:*:*:*:*:*:*:*
cpe:2.3:a:php_icalendar:php_icalendar:2.0:*:*:*:*:*:*:*
cpe:2.3:a:php_icalendar:php_icalendar:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:php_icalendar:php_icalendar:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:php_icalendar:php_icalendar:2.0a2:*:*:*:*:*:*:*
cpe:2.3:a:php_icalendar:php_icalendar:2.0a2:*:*:*:*:*:*:*
cpe:2.3:a:php_icalendar:php_icalendar:2.0b:*:*:*:*:*:*:*
cpe:2.3:a:php_icalendar:php_icalendar:2.0b:*:*:*:*:*:*:*
cpe:2.3:a:php_icalendar:php_icalendar:2.0c:*:*:*:*:*:*:*
cpe:2.3:a:php_icalendar:php_icalendar:2.0c:*:*:*:*:*:*:*
cpe:2.3:a:php_icalendar:php_icalendar:2.1:*:*:*:*:*:*:*
cpe:2.3:a:php_icalendar:php_icalendar:2.1:*:*:*:*:*:*:*
cpe:2.3:a:php_icalendar:php_icalendar:*:*:*:*:*:*:*:*
cpe:2.3:a:php_icalendar:php_icalendar:*:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 11-10-2017 - 01:30)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bid	17129
exploit-db	1586
misc	http://downloads.securityfocus.com/vulnerabilities/exploits/php-iCalendar-221.upload.php
secunia	19285
vupen	ADV-2006-1019

Last major update

11-10-2017 - 01:30

Published

19-03-2006 - 23:02

Last modified

11-10-2017 - 01:30