Vulnerability Details : CVE-2004-1423

Multiple PHP remote file inclusion vulnerabilities in Sean Proctor PHP-Calendar before 0.10.1, as used in Commonwealth of Massachusetts Virtual Law Office (VLO) and other products, allow remote attackers to execute arbitrary PHP code via a URL in the phpc_root_path parameter to (1) includes/calendar.php or (2) includes/setup.php.

Vulnerability category: File inclusion

Published 2004-12-31 05:00:00

Updated 2018-10-19 15:30:49

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2004-1423

Probability of exploitation activity in the next 30 days: 23.72%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 96 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2004-1423

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	[email protected]
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2004-1423

CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Assigned by: [email protected] (Primary)

References for CVE-2004-1423

Products affected by CVE-2004-1423

Php-calendar » Php-calendar
Versions up to, including, (<=) 0.10
cpe:2.3:a:php-calendar:php-calendar:*:*:*:*:*:*:*:*
Matching versions
Php-calendar » Php-calendar » Version: 0.8
cpe:2.3:a:php-calendar:php-calendar:0.8:*:*:*:*:*:*:*
Matching versions
Php-calendar » Php-calendar » Version: 0.9
cpe:2.3:a:php-calendar:php-calendar:0.9:*:*:*:*:*:*:*
Matching versions
Php-calendar » Php-calendar » Version: 0.1
cpe:2.3:a:php-calendar:php-calendar:0.1:*:*:*:*:*:*:*
Matching versions
Php-calendar » Php-calendar » Version: 0.2
cpe:2.3:a:php-calendar:php-calendar:0.2:*:*:*:*:*:*:*
Matching versions
Php-calendar » Php-calendar » Version: 0.9.1
cpe:2.3:a:php-calendar:php-calendar:0.9.1:*:*:*:*:*:*:*
Matching versions
Php-calendar » Php-calendar » Version: 0.5
cpe:2.3:a:php-calendar:php-calendar:0.5:*:*:*:*:*:*:*
Matching versions
Php-calendar » Php-calendar » Version: 0.6
cpe:2.3:a:php-calendar:php-calendar:0.6:*:*:*:*:*:*:*
Matching versions
Php-calendar » Php-calendar » Version: 0.7
cpe:2.3:a:php-calendar:php-calendar:0.7:*:*:*:*:*:*:*
Matching versions
Php-calendar » Php-calendar » Version: 0.3
cpe:2.3:a:php-calendar:php-calendar:0.3:*:*:*:*:*:*:*
Matching versions
Php-calendar » Php-calendar » Version: 0.4
cpe:2.3:a:php-calendar:php-calendar:0.4:*:*:*:*:*:*:*
Matching versions