CVEvulnerability

CVE-2005-3366

6.8 MEDIUM Published 2005-10-30 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2005-10-30
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P

Description

PHP file inclusion vulnerability in index.php in PHP iCalendar 2.0a2 through 2.0.1 allows remote attackers to execute arbitrary PHP code and include arbitrary local files via the phpicalendar cookie. NOTE: this is not a cross-site scripting (XSS) issue as claimed by the original researcher.

Affected configurations

• php icalendar php icalendar 2.0.1 • php icalendar php icalendar 2.0a2 • php icalendar php icalendar 2.0b • php icalendar php icalendar 2.0c

References