Intrusion Prevention

PHP.showcode.php.PAGE.Parameter.File.Inclusion

Description

This indicates an attempt to exploit a PHP remote file inclusion vulnerability in ActiveCalendar.
The vulnerability is due to an input validation error in the "data/showcode.php" script. The script does not validate the "page" parameter before it is passed to an "fread()" call. This can be exploited by remote attackers to disclose the contents of arbitrary files.

Affected Products

Active Calendar 1.2

Impact

System Compromise.

Recommended Actions

Apply the latest update from the vendor:
http://www.micronetwork.de/activecalendar/.

CVE References

CVE-2007-1110