PHP.showcode.php.PAGE.Parameter.File.Inclusion
Description
This indicates an attempt to exploit a PHP remote file inclusion vulnerability in ActiveCalendar.
The vulnerability is due to an input validation error in the "data/showcode.php" script. The script does not validate the "page" parameter before it is passed to an "fread()" call. This can be exploited by remote attackers to disclose the contents of arbitrary files.
Affected Products
Active Calendar 1.2
Impact
System Compromise.
Recommended Actions
Apply the latest update from the vendor:
http://www.micronetwork.de/activecalendar/.
Telemetry
Coverage
IPS (Regular DB) | |
IPS (Extended DB) |