Title: WebCalendar 'tools/send_reminders.php' Remote File Include Vulnerability
Severity: HIGH
Description:
WebCalendar is a web-based calendar application implemented in PHP.
The application is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input to the 'includedir' parameter of the 'tools/send_reminders.php' script.
An attacker can exploit this issue to execute malicious PHP code in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.
WebCalendar 1.0.4 is vulnerable; other versions may be affected as well.
Affected Products:
- k5n WebCalendar 1.0.4
References:
- k5n: Vendor Homepage