PHP-Calendar v1.1 'configfile' Remote and Local File Inclusion vulnerability
Remote and local file inclusion in PHP-Calendar via the configfile parameter.
Antecedentes
PHP-Calendar is a simple web calendar aimed at groups that need to create and track events collaboratively. Its source code is available under an open-source license.
Description
The configfile variable is not properly filtered and allows the inclusion of arbitrary remote and local files, which can lead to arbitrary code execution. The vulnerable code is in update08.php and update10.php. To include remote files, the allow_url_fopen directive must be set to On; additionally, the file_exists check can be bypassed, for example with SMB paths on Windows servers without a firewall that filters outgoing SMB requests.
Business impact
Unauthenticated users can view any local system file and could execute arbitrary code remotely.
Affected systems
PHP-Calendar version 1.1; other versions may be affected.
Solución
Modify the code in update08.php (line 38) and update10.php (line 35) to filter the $_GET['configfile'] variable with a regular expression that only allows alphanumeric characters and underscores.
Calendario de divulgación
References
The information contained within this advisory is supplied 'as-is' with no warranties or guarantees of fitness for use or otherwise. Internet Security Auditors accepts no responsibility for any damage caused by the use or misuse of this information.
Company based in Spain and Colombia, specializing in web application auditing, network security, penetration testing, and compliance implementation and assessment. Our clients include some of the largest finance, telecommunications, insurance, and ICT companies. A vendor-independent provider with in-depth experience since 2001. Our R&D efforts include vulnerability research, collaboration on open security projects, whitepapers, and participation in industry events.
Would you like us to review your product?
Contact usDo you need a security audit?
Tell us about your situation and our team will get in touch with you to provide guidance or schedule a technical call.
Request information
Our offices
Transversal 22 # 98-82, Porta 100 Building, Office 1003
110221 Bogotá (Colombia)