CVE-2008-5967

HIGH 7.5CVE-2008-5967 · Published 26/01/2009 · updated 16/06/2026

In short

CVE-2008-5967 is a HIGH (CVSS 7.5) vulnerability affecting phpicalendar (phpicalendar).
Chance of exploitation in the next 30 days (EPSS): 3.3%, higher than 88.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
phpicalendar phpicalendar	`= 0.7= 0.8= 0.9= 0.9.5= 1.0= 1.1= 2.0= 2.0.1= 2.0c= 2.1= 2.2= 2.21= 2.22= 2.23= 2.24≤ 2.3.4`	No fix yet

Description

admin/index.php in PHP iCalendar 2.3.4, 2.24, and earlier does not require administrative authentication for an addupdate action, which allows remote attackers to upload a calendar (aka .ics) file with arbitrary content to the calendars/ directory outside the web root.

References

secunia.com/advisories/31944 · Vendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/48323
exploit-db.com/exploits/6519

More vulnerabilities in phpicalendar

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free