PHP.showcode.php.PAGE.Parameter.File.Inclusion

description-logoDescription

This indicates an attempt to exploit a PHP remote file inclusion vulnerability in ActiveCalendar.
The vulnerability is due to an input validation error in the "data/showcode.php" script. The script does not validate the "page" parameter before it is passed to an "fread()" call. This can be exploited by remote attackers to disclose the contents of arbitrary files.

affected-products-logoAffected Products

Active Calendar 1.2

Impact logoImpact

System Compromise.

recomended-action-logoRecommended Actions

Apply the latest update from the vendor:
http://www.micronetwork.de/activecalendar/.

Telemetry logoTelemetry

Coverage

IPS (Regular DB)
IPS (Extended DB)