This host is running PHP Calendar and is prone to Remote And Local File Inclusion vulnerability.

Successful exploitation will allow attacker to include and execute arbitrary files from local and external resources, and can gain sensitive information about remote system directories when register_globals is enabled. Impact level: Application

Upgrade to PHP-Calendar version 1.4 or later, For updates refer to http://www.cascade.org.uk/software/php/calendar/

The flaw is due to error in 'configfile' parameter in 'update08.php' and 'update10.php' which is not properly verified before being used to include files.

PHP-Calendar version 1.1 and prior on all platforms.

• http://www.securityfocus.com/archive/1/archive/1/508548/100/0/threaded

---

Updated on 2015-03-25