|
Description
|
|
Egidio Romano has discovered a vulnerability in WebCalendar, which can be exploited by malicious users to disclose sensitive information.
Input passed via the "pref_THEME" parameter to pref.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources via directory traversal attacks and URL-encoded NULL bytes.
Successful exploitation requires that "magic_quotes_gpc" is disabled.
The vulnerability is confirmed in version 1.2.4. Prior versions may also be affected.
|
