Lucene search

[email protected]CVE-2006-1291

HistoryMar 19, 2006 - 11:02 p.m.

CVE-2006-1291

2006-03-1923:02:00

[email protected]

web.nvd.nist.gov

cve-2006-1291

remote code execution

php icalendar

webdav

security vulnerability

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7.7 High

AI Score

Confidence

Low

0.067 Low

EPSS

Percentile

93.9%

JSON

publish.ical.php in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier does not require authentication for write access to the calendars directory, which allows remote attackers to upload and execute arbitrary PHP scripts via a WebDAV PUT request with a filename containing a .php extension and a trailing null character.

Affected configurations

NVD

Node

php_icalendarphp_icalendarRange≤2.2.1

php_icalendarphp_icalendarMatch2.0

php_icalendarphp_icalendarMatch2.0.1

php_icalendarphp_icalendarMatch2.0a2

php_icalendarphp_icalendarMatch2.0b

php_icalendarphp_icalendarMatch2.0c

php_icalendarphp_icalendarMatch2.1

CPENameOperatorVersion
php_icalendar:php_icalendarphp icalendarle2.2.1
php_icalendar:php_icalendarphp icalendareq2.0
php_icalendar:php_icalendarphp icalendareq2.0.1
php_icalendar:php_icalendarphp icalendareq2.0a2
php_icalendar:php_icalendarphp icalendareq2.0b
php_icalendar:php_icalendarphp icalendareq2.0c
php_icalendar:php_icalendarphp icalendareq2.1

CPE	Name	Operator	Version
php_icalendar:php_icalendar	php icalendar	le	2.2.1
php_icalendar:php_icalendar	php icalendar	eq	2.0
php_icalendar:php_icalendar	php icalendar	eq	2.0.1
php_icalendar:php_icalendar	php icalendar	eq	2.0a2
php_icalendar:php_icalendar	php icalendar	eq	2.0b
php_icalendar:php_icalendar	php icalendar	eq	2.0c
php_icalendar:php_icalendar	php icalendar	eq	2.1

References

downloads.securityfocus.com/vulnerabilities/exploits/php-iCalendar-221.upload.php

secunia.com/advisories/19285

www.securityfocus.com/bid/17129

www.vupen.com/english/advisories/2006/1019

www.exploit-db.com/exploits/1586

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7.7 High

AI Score

Confidence

Low

0.067 Low

EPSS

Percentile

93.9%

JSON

Related for CVE-2006-1291

nessus1 prion1 cvelist1 nvd1