CVE-2006-1292

Опубликовано: 19 мар. 2006

Источник: nvd

CVSS2: 5

EPSS Низкий

Описание

Directory traversal vulnerability in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in the phpicalendar[cookie_language] and phpicalendar[cookie_style] cookies, as demonstrated by injecting PHP sequences into an Apache access_log file, which is then included by day.php.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:php_icalendar:php_icalendar:*:*:*:*:*:*:*:*

Версия до 2.2.1 (включая)

cpe:2.3:a:php_icalendar:php_icalendar:2.0:*:*:*:*:*:*:*

cpe:2.3:a:php_icalendar:php_icalendar:2.0.1:*:*:*:*:*:*:*

cpe:2.3:a:php_icalendar:php_icalendar:2.0a2:*:*:*:*:*:*:*

cpe:2.3:a:php_icalendar:php_icalendar:2.0b:*:*:*:*:*:*:*

cpe:2.3:a:php_icalendar:php_icalendar:2.0c:*:*:*:*:*:*:*

cpe:2.3:a:php_icalendar:php_icalendar:2.1:*:*:*:*:*:*:*

EPSS

Процентиль: 91%

0.07303

Низкий

5 Medium

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

GHSA-mfgx-9ppg-hfqp

github

почти 4 года назад