FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2006-2762

This CVE name corresponds to:

Entered	Topic
2006-06-16	WebCalendar -- information disclosure vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2006-2762 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2006-2762
Phase	Assigned(20060601)

Description

PHP remote file inclusion vulnerability in includes/config.php in WebCalendar 1.0.3 allows remote attackers to execute arbitrary PHP code via a URL in the includedir parameter, which is remotely accessed in an fopen call whose results are used to define a user_inc setting that is used in an include_once call.

References

Source	Reference
BUGTRAQ	20060530 WebCalendar-1.0.3 reading of any files
BUGTRAQ	20060607 Re: WebCalendar-1.0.3 reading of any files
DEBIAN	DSA-1096
BID	18175
VUPEN	ADV-2006-2067
OSVDB	25842
SECTRACK	1016179
SECUNIA	20367
SECUNIA	20542
SREASON	1019