CVE-2006-0648 - Multiple directory traversal vulnerabilities in PHP iCalendar 2.0.1, 2.1, and 2.2 allow remote attac

CVE-2006-0648

Summary

Multiple directory traversal vulnerabilities in PHP iCalendar 2.0.1, 2.1, and 2.2 allow remote attackers to include arbitrary files via the (1) getdate and possibly other parameters used in the replace_files function in search.php and (2) $file variable as used in the parse function in functions/template.php.

References

Vulnerable Configurations

cpe:2.3:a:php_icalendar:php_icalendar:2.0:*:*:*:*:*:*:*
cpe:2.3:a:php_icalendar:php_icalendar:2.0:*:*:*:*:*:*:*
cpe:2.3:a:php_icalendar:php_icalendar:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:php_icalendar:php_icalendar:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:php_icalendar:php_icalendar:2.1:*:*:*:*:*:*:*
cpe:2.3:a:php_icalendar:php_icalendar:2.1:*:*:*:*:*:*:*

CVSS

Base:	5.0 (as of 19-10-2018 - 15:45)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	NONE

cvss-vector via4

AV:N/AC:L/Au:N/C:N/I:P/A:N

refmap via4

bid	16557
bugtraq	20060208 [eVuln] PHP iCalendar File Inclusion Vulnerability
confirm	http://phpicalendar.net/forums/viewtopic.php?t=396
misc	http://evuln.com/vulns/70/summary.html
secunia	18778
sreason	420
vupen	ADV-2006-0493
xf	phpicalendar-template-search-file-include(24591)

Last major update

19-10-2018 - 15:45

Published

13-02-2006 - 11:06

Last modified

19-10-2018 - 15:45