Vulnerability CVE-2012-1495
Published: 2020-01-27

Description:
install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the form_single_user_login parameter.

See advisories in our WLB2 database:
Topic
Author
Date
High
WebCalendar 1.2.4 Remote Code Injection (Metasploit)
sinn3r
01.05.2012
High
WebCalendar 1.2.4 Remote Code Execution (PHP Exploit)
EgiX
01.05.2012

Type:

CWE-74

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Webcalendar project -> Webcalendar 

 References:
http://sourceforge.net/projects/webcalendar/files/webcalendar%201.2/1.2.5/
https://packetstormsecurity.com/files/112323/WebCalendar-1.2.4-Pre-Auth-Remote-Code-Injection.html
https://packetstormsecurity.com/files/112332/WebCalendar-1.2.4-Remote-Code-Execution.html
https://www.exploit-db.com/exploits/18775
Copyright 2024, cxsecurity.com

 

Back to Top