CVE-2006-1292
Directory traversal vulnerability in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in the…
Does this matter?
Lower severity and a low EPSS score (2.85%). Track it; it rarely justifies an emergency change on its own.
Description
Directory traversal vulnerability in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in the phpicalendar[cookie_language] and phpicalendar[cookie_style] cookies, as demonstrated by injecting PHP sequences into an Apache access_log file, which is then included by day.php.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
- EPSS
- 2.85% probability · 86th percentile
- CISA KEV
- Not listed
- Affected
- php icalendar/php icalendar
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/19285
- http://www.securityfocus.com/bid/17125
- http://www.vupen.com/english/advisories/2006/1019
- https://www.exploit-db.com/exploits/1585
- http://secunia.com/advisories/19285
- http://www.securityfocus.com/bid/17125
- http://www.vupen.com/english/advisories/2006/1019
- https://www.exploit-db.com/exploits/1585
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.