CVE-2009-4928

PHP remote file inclusion vulnerability in config.php in TotalCalendar 2.4 allows remote attackers to execute arbitrary PHP code via a URL in the incdir parameter, a different vector than CVE-2006-1922 and CVE-2006-7055...

CVE-2009-4929

admin/manageusers.php in TotalCalendar 2.4 does not require administrative authentication, which allows remote attackers to change arbitrary passwords via the newPW1 and newPW2 parameters...

Remote file inclusion

PHP remote file inclusion vulnerability in config.php in TotalCalendar 2.4 allows remote attackers to execute arbitrary PHP code via a URL in the incdir parameter, a different vector than CVE-2006-1922 and CVE-2006-7055...

Authentication flaw

admin/manageusers.php in TotalCalendar 2.4 does not require administrative authentication, which allows remote attackers to change arbitrary passwords via the newPW1 and newPW2 parameters...

CVE-2009-4928

CVE-2009-4928 describes a PHP remote file inclusion vulnerability in TotalCalendar 2.4, where an attacker can cause arbitrary PHP code execution via a URL in the inc_dir parameter of config.php. The entry notes a distinct vector from CVE-2006-1922 and CVE-2006-7055. The provided documents reitera...

CVE-2009-4929

admin/manageusers.php in TotalCalendar 2.4 does not require administrative authentication, which allows remote attackers to change arbitrary passwords via the newPW1 and newPW2 parameters...

CVE-2009-4928

PHP remote file inclusion vulnerability in config.php in TotalCalendar 2.4 allows remote attackers to execute arbitrary PHP code via a URL in the incdir parameter, a different vector than CVE-2006-1922 and CVE-2006-7055...

CVE-2009-4929

TotalCalendar 2.4 is affected. The vulnerability is in admin/manage_users.php which does not require administrative authentication, allowing remote attackers to change arbitrary passwords via the newPW1/newPW2 parameters. CVSSv2 base score is 7.5 (HIGH) with network attack vector, no authenticati...

TotalCalendar 2.4 (bSQL/LFI) Multiple Remote Vulnerabilities

No description provided by source. / | | \ \ / / | | \ \ / / | |\ \ /\ / / | | | | | | \ V /| | | \ V V / | | || | || / ||| // ,|, | |/ | | | |/ / | ' \ | | / | | | | | | | |||,|| || || TotalCalendar 2.4 bSQL/LFI Multiples Remote Vulnerability Discovered By : Moudi Contact : [email protected]...

TotalCalendar 2.4 (bSQL/LFI) Multiple Remote Vulnerabilities

Exploit for unknown platform in category web applications ============================================================ TotalCalendar 2.4 bSQL/LFI Multiple Remote Vulnerabilities ============================================================ / | | \ \ / / | | \ \ / / | |\ \ /\ / / | | | | | | \ V /|...

totalcalendar 2.4 - Blind SQL Injection / Local File Inclusion

/ | | \ \ / / | | \ \ / / | |\ \ /\ / / | | | | | | \ V /| | | \ V V / | | || | || / ||| // ,|, | |/ | | | |/ / | ' \ | | / | | | | | | | |||,|| || || TotalCalendar 2.4 bSQL/LFI Multiples Remote Vulnerability Discovered By : Moudi Contact : Download :...

Total Calendar 2.4 SQL Injection / LFI

/ | | \ \ / / | | \ \ / / | |\ \ /\ / / | | | | | | \ V /| | | \ V V / | | || | || / ||| // ,|, | |/ | | | |/ / | ' \ | | / | | | | | | | |||,|| || || TotalCalendar 2.4 bSQL/LFI Multiples Remote Vulnerability Discovered By : Moudi Contact : Download :...

totalcalendar 2.4 - Blind SQL Injection Local File Inclusion

totalcalendar 2.4 - Blind SQL Injection Local File Inclusion / | | \ \ / / | | \ \ / / | |\ \ /\ / / | | | | | | \ V /| | | \ V V / | | || | || / ||| // ,|, | |/ | | | |/ / | ' \ | | / | | | | | | | |||,|| || || TotalCalendar 2.4 bSQL/LFI Multiples Remote Vulnerability Discovered By : Moudi...

TotalCalendar cms_detect.php模块本地文件包含漏洞

BUGTRAQ ID: 34634 CVECAN ID: CVE-2009-1406 TotalCalendar是一种基于Web的日程管理系统。 TotalCalendar的cmsdetect.php模块没有正确地验证对include参数所传送的输入便用于包含文件，远程攻击者可以通过目录遍历攻击包含本地资源的任意文件。以下是cmsdetect.php中的有漏洞代码段： ------------------------------------------------------------------------------- Line 26 : $include =...

CVE-2009-1406

Directory traversal vulnerability in cmsdetect.php in TotalCalendar 2.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the include parameter...

Directory traversal

Directory traversal vulnerability in cmsdetect.php in TotalCalendar 2.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the include parameter...

CVE-2009-1406

TotalCalendar 2.4 is affected by a directory traversal in cms_detect.php: the include parameter is not properly validated, enabling remote attackers to include and execute local files. Exploitation example shown: include=../../../../../../BOOTSECT.BAK. Root cause is unsanitized input used in requ...

CVE-2009-1406

Directory traversal vulnerability in cmsdetect.php in TotalCalendar 2.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the include parameter...

TotalCalendar 2.4 (inc_dir) Remote File Inclusion Vulnerability

No description provided by source. //// //1 9 2 3 T U R K - G R U P// //// //-----------------------------------------------------------------------// --+-- Home Page : "http://www.simpoe.com/" Download : "http://www.simpoe.com/calendre/TotalCalendar2.4.zip" ScriptName: "Simpoe Event Calendar"...

TotalCalendar 2.4 (include) Local File Inclusion Vulnerability

Exploit for unknown platform in category web applications ============================================================== TotalCalendar 2.4 include Local File Inclusion Vulnerability ============================================================== + TotalCalendar 2.4 include Local File Inclusion +...