SecuritySpace - CVE-2009-3702

Vulnerability Search		Search 324607 CVE descriptions and 145615 test descriptions, access 10,000+ cross references.
	Tests CVE All

CVE ID: CVE-2009-3702

Description: Multiple absolute path traversal vulnerabilities in PHP-Calendar 1.1 allow remote attackers to include and execute arbitrary local files via a full pathname in the configfile parameter to (1) update08.php or (2) update10.php. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.

Test IDs: 1.3.6.1.4.1.25623.1.0.901090

Cross References: Common Vulnerability Exposure (CVE) ID: CVE-2009-3702
Bugtraq: 20091218 [ISecAuditors Security Advisories] PHP-Calendar <= v1.1 'configfile' Remote and Local File Inclusion vulnerability (Google Search)
http://www.securityfocus.com/archive/1/508548/100/0/threaded

CVE ID:	CVE-2009-3702
Description:	Multiple absolute path traversal vulnerabilities in PHP-Calendar 1.1 allow remote attackers to include and execute arbitrary local files via a full pathname in the configfile parameter to (1) update08.php or (2) update10.php. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.
Test IDs:	1.3.6.1.4.1.25623.1.0.901090
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2009-3702 Bugtraq: 20091218 [ISecAuditors Security Advisories] PHP-Calendar <= v1.1 'configfile' Remote and Local File Inclusion vulnerability (Google Search) http://www.securityfocus.com/archive/1/508548/100/0/threaded