CRLF injection vulnerability in layers_toggle.php in WebCalendar 1.0.1 might allow remote attackers to modify HTTP headers and conduct HTTP response splitting attacks via the ret parameter, which is used to redirect URL requests.

Several security related problems have been discovered in webcalendar, a PHP based multi-user calendar. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities :

  - CVE-2005-3949     Multiple SQL injection vulnerabilities allow remote     attackers to execute arbitrary SQL commands.

  - CVE-2005-3961     Missing input sanitising allows an attacker to overwrite     local files.

  - CVE-2005-3982     A CRLF injection vulnerability allows remote attackers     to modify HTTP headers and conduct HTTP response     splitting attacks.

The remote version of WebCalendar does not validate input to the 'id' and 'format' parameters of the 'export_handler.php' script before using it to overwrite files on the remote host, subject to the privileges of the web server user id. 

In addition, the 'activity_log.php', 'admin_handler.php', 'edit_report_handler.php', 'edit_template.php' and 'export_handler.php' scripts are prone to SQL injection attacks and the 'layers_toggle.php' script is prone to HTTP response splitting attacks.

The remote web server has a PHP application that is affected by multiple vulnerabilities. The remote version of WebCalendar does not validate input to the 'id' and 'format' parameters of the 'export_handler.php' script before using it to overwrite files on the remote host, subject to the privileges of the web server user ID. In addition, the 'activity_log.php', 'admin_handler.php', 'edit_report_handler.php', 'edit_template.php' and 'export_handler.php' scripts are prone to SQL injection attacks and the 'layers_toggle.php' script is prone to HTTP response splitting attacks.

ID	Name	Product	Family	Severity
22544	Debian DSA-1002-1 : webcalendar - several vulnerabilities	Nessus	Debian Local Security Checks	high
20250	WebCalendar < 1.0.2 Multiple Vulnerabilities	Nessus	CGI abuses	high
3303	WebCalendar < 1.0.2 Multiple Vulnerabilities	Nessus Network Monitor	CGI	high

Detections

Analytics

CVE-2005-3982

medium

Tenable Plugins

high

high

high