Vulnerability Details : CVE-2005-3366
Potential exploit
PHP file inclusion vulnerability in index.php in PHP iCalendar 2.0a2 through 2.0.1 allows remote attackers to execute arbitrary PHP code and include arbitrary local files via the phpicalendar cookie. NOTE: this is not a cross-site scripting (XSS) issue as claimed by the original researcher.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2005-3366
- cpe:2.3:a:php_icalendar:php_icalendar:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:php_icalendar:php_icalendar:2.0a2:*:*:*:*:*:*:*
- cpe:2.3:a:php_icalendar:php_icalendar:2.0b:*:*:*:*:*:*:*
- cpe:2.3:a:php_icalendar:php_icalendar:2.0c:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2005-3366
3.83%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 87 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2005-3366
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST |
References for CVE-2005-3366
-
http://www.ush.it/2005/10/25/php-icalendar-css/
Error 404Exploit;Patch;Vendor Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/22864
-
http://www.vupen.com/english/advisories/2005/2204
-
http://securitytracker.com/id?1015102
-
http://www.securityfocus.com/bid/15193
-
http://securityreason.com/securityalert/113
-
http://secunia.com/advisories/17328/
Vendor Advisory
-
http://marc.info/?l=bugtraq&m=113025930517426&w=2
-
http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0512.html
Exploit;Patch;Vendor Advisory
Jump to