CVE-2007-1343 - Secunia Advisories - Vulnerability Information

CVE Reference: CVE-2007-1343
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE: CVE-2007-1343

Description: includes/functions.php in Craig Knudsen WebCalendar before 1.0.5 does not protect the noSet variable from external modification, which allows remote attackers to set arbitrary global variables via a URL with modified values in the noSet parameter, which leads to resultant vulnerabilities that probably include remote file inclusion and other issues.

CVE Status: Candidate

References: XF http://xforce.iss.net/xforce/xfdb/32832 SAID Secunia Advisory: SA24403 Secunia Advisory: SA24519 MLIST http://sourceforge.net/mailarchive/forum.php?thread_id=31840112&forum_id=46247 DEBIAN http://www.debian.org/security/2007/dsa-1267 CONFIRM http://webcalendar.cvs.sourceforge.net/webcalendar/webcalendar/includes/functions.php?r1=1.211.2.7&r2=1.211.2.8 http://webcalendar.cvs.sourceforge.net/webcalendar/webcalendar/includes/functions.php?view=log http://sourceforge.net/project/shownotes.php?group_id=3870&release_id=491130 BID 22834

Return to the previous page.