CVE-2008-5062

Mini Web Calendar 1.2 - Path Traversal via cal_pdf.php thefile Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-5062. PoCs published by ahmadbady.

AI-analyzed exploit summary The exploit demonstrates two vulnerabilities in Mini Web Calendar 1.2: a local file inclusion (LFI) via `cal_pdf.php` and a reflected XSS via `cal_default.php`. Both are trivial to execute and require no authentication.

Description

Directory traversal vulnerability in php/cal_pdf.php in Mini Web Calendar (mwcal) 1.2 allows remote attackers to read arbitrary files via directory traversal sequences in the thefile parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by ahmadbady · textwebappsphp

https://www.exploit-db.com/exploits/7049

View Code ZIP pw:eip

The exploit demonstrates two vulnerabilities in Mini Web Calendar 1.2: a local file inclusion (LFI) via `cal_pdf.php` and a reflected XSS via `cal_default.php`. Both are trivial to execute and require no authentication.

Classification

Working Poc 90%

Attack Type

Xss | Info Leak

Complexity

Trivial

Reliability

Reliable

Target: Mini Web Calendar 1.2

No auth needed

Prerequisites: Access to the target web application

MITRE ATT&CK