CVE-2006-2261

CVE-2006-2261 affects ACal 2.2.6. The embed/day.php script does not sanitize the path parameter before using it in PHP include(), enabling a remote file inclusion that can allow arbitrary PHP code execution if PHP register_globals is enabled; the exact exploit details are not provided in the docu...