Design/Logic Flaw

2009-04-2118:30:00

PRIOn knowledge base

www.prio-n.com

7.2 High

AI Score

Confidence

Low

0.022 Low

EPSS

Percentile

89.4%

JSON

Flat Calendar 1.1 does not properly restrict access to administrative functions, which allows remote attackers to (1) add new events via calAdd.php, as reachable from admin/add.php, or (2) delete events via admin/deleteEvent.php. NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product’s security documentation.

CPENameOperatorVersion
flat_calendareq1.1

CPE	Name	Operator	Version
	flat_calendar	eq	1.1

References

osvdb.org/51506

www.securityfocus.com/archive/1/493278/100/0/threaded

www.securityfocus.com/bid/29662

exchange.xforce.ibmcloud.com/vulnerabilities/43039