WebCalendar "includedir" Remote PHP File Inclusion Vulnerability

[TJ]

* Technical Description *

A vulnerability was identified in WebCalendar, which may be exploited by attackers to compromise a vulnerable web server. This flaw is due to an input validation error in the "send_reminders.php" script when processing a specially crafted "includedir" parameter, which may be exploited by remote attackers to include malicious files and execute arbitrary commands with the privileges of the web server.

 * Affected Products *

WebCalendar prior to version 1.0.1

 * Solution *

Upgrade to WebCalendar version 1.0.1 :
http://www.k5n.us/webcalendar.php?topic=Download

 * References *

http://www.frsirt.com/english/advisories/2005/1513