PT-2006-6145 · Local · Local Calendar System
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
LoCal Calendar System version 1.1
Description
The issue allows remote attackers to execute arbitrary PHP code via a URL in the
LIBDIR parameter in lib/lcUser.php.Recommendations
For LoCal Calendar System version 1.1, consider restricting access to the
LIBDIR parameter to minimize the risk of exploitation. Avoid using the LIBDIR parameter in the affected API endpoint until the issue is resolved.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Local Calendar System