vendor:
WebCalendar
by:
Cr@zy_King
5.5
CVSS
MEDIUM
Remote File Inclusion
98
CWE
Product Name: WebCalendar
Affected Version From: 1.0.4
Affected Version To: 1.0.4
Patch Exists: NO
Related CWE:
CPE: a:webcalendar:webcalendar:1.0.4
Platforms Tested:
2008
WebCalendar v1.0.4 Remote File Include
This exploit allows an attacker to include remote files in the WebCalendar v1.0.4 application. The vulnerability is triggered by the 'includedir' parameter in the 'send_reminders.php' file. By manipulating this parameter, an attacker can include a malicious file hosted on a remote server.
Mitigation:
To mitigate this vulnerability, it is recommended to update to a newer version of WebCalendar that addresses this issue. Additionally, input validation should be implemented to prevent the inclusion of remote files.
