HTTP: PHP-Calendar File Include Vulnerability

This signature detects attempts to exploit a known vulnerability against PHP-Calendar, a popular open-source calendar program. Attackers can send malformed requests and execute arbitrary PHP commands on the web server.

Extended Description

A remote file include vulnerability affects PHP-Calendar. This issue is due to a failure of the application to properly sanitize user-supplied input prior to using it in a PHP 'include()' function call. An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This will facilitate unauthorized access.

Affected Products

Php-calendar php-calendar

References

BugTraq: 12127

CVE: CVE-2004-1423

URL: http://www.gulftech.org/?node=research&article_id=00060-12292004 http://php-calendar.sourceforge.net/ http://www.securityspace.com/smysecure/catid.html?id=16071

Short Name

HTTP:PHP:PHP-CAL-FILE-INC

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: PHP-Calendar File Include Vulnerability

Extended Description

Affected Products

References

Found a potential security threat?