CVE-2012-1495

This Metasploit module exploits a pre-authentication remote code injection vulnerability in WebCalendar 1.2.4 by abusing the settings.php script to inject arbitrary PHP code, leading to remote command execution as the www-data user.

This exploit targets CVE-2012-1496 in WebCalendar <= 1.2.4, leveraging a Local File Inclusion (LFI) vulnerability in /pref.php to achieve Remote Code Execution (RCE) by injecting PHP code into /includes/settings.php via the installation script.

This repository provides instructions for setting up a Docker container with WebCalendar and suggests using Metasploit to exploit CVE-2012-1495. It does not contain actual exploit code but references external tools.

This Metasploit module exploits a pre-authentication remote code injection vulnerability in WebCalendar 1.2.4 by abusing the settings.php script to inject arbitrary PHP code, leading to command execution as the www-data user.