EgiX has discovered a vulnerability in phpScheduleIt, which can be exploited by malicious people to compromise a vulnerable system.

Input passed to the "start_date" parameter in reserve.php is not properly sanitised before being used in "eval()" calls. This can be exploited to execute arbitrary PHP code.

Successful exploitation of this vulnerability requires that "magic_quotes_pgc" is disabled.

This vulnerability has been confirmed in version 1.2.10. Prior versions may also be affected.

Solution
Update to version 1.2.11.

Provided and/or discovered by
EgiX

Changelog
Further details available to Secunia VIM customers

Original Advisory
phpScheduleIt:
http://sourceforge.net/project/shownotes.php?release_id=662749

milw0rm:
http://milw0rm.com/exploits/6646

Deep Links
Links available to Secunia VIM customers