CVE-2004-1423
php-calendar < 0.10.1 - Remote Code Execution via phpc_root_path Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2004-1423. PoCs published by Mehmet Ince, GulfTech Security.
AI-analyzed exploit summary This exploit demonstrates a remote file inclusion vulnerability in Virtual Law Office's phpcalendar component. The vulnerability allows an attacker to include arbitrary remote files via the `phpc_root_path` parameter, leading to potential remote code execution.
Description
Multiple PHP remote file inclusion vulnerabilities in Sean Proctor PHP-Calendar before 0.10.1, as used in Commonwealth of Massachusetts Virtual Law Office (VLO) and other products, allow remote attackers to execute arbitrary PHP code via a URL in the phpc_root_path parameter to (1) includes/calendar.php or (2) includes/setup.php.
Exploits (2)
This exploit demonstrates a remote file inclusion vulnerability in Virtual Law Office's phpcalendar component. The vulnerability allows an attacker to include arbitrary remote files via the `phpc_root_path` parameter, leading to potential remote code execution.
This is a vulnerability writeup describing an arbitrary file inclusion flaw in PHP-Calendar <= 0.10.1. The issue allows remote attackers to include arbitrary PHP files via the `phpc_root_path` parameter, potentially leading to remote code execution if PHP globals are enabled.