CVEvulnerability

CVE-2006-1292

5.0 MEDIUM Published 2006-03-19 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2006-03-19
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N

Description

Directory traversal vulnerability in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in the phpicalendar[cookie_language] and phpicalendar[cookie_style] cookies, as demonstrated by injecting PHP sequences into an Apache access_log file, which is then included by day.php.

Affected configurations

• php icalendar php icalendar (<= 2.2.1) • php icalendar php icalendar 2.0 • php icalendar php icalendar 2.0.1 • php icalendar php icalendar 2.0a2 • php icalendar php icalendar 2.0b • php icalendar php icalendar 2.0c • php icalendar php icalendar 2.1

References