CVE-2007-3259 Calendarix Multiple Path Disclosure Vulnerability Advisory

Critical Vulnerability Information Vulnerability Name: Calendarix version 0.7. 20070307 Multiple Path Disclosure Vulnerabilities CVE ID: CVE-2007-3259 Release Date: 2007.06.28 Risk Level: Medium Local Vulnerability: No Remote Vulnerability: Yes CVSS Score Base Score: 5/10 Attack Complexity: Low Authentication Required: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None Vulnerability Description Calendarix is an easy-to-use calendar application built with PHP and MySQL. Due to security flaws in the product, attackers can obtain the real path of server-side scripts. Vulnerability Type Software Defect: The product's scripts contain defects that trigger warnings or fatal errors. Specific Vulnerability: Multiple path disclosure vulnerabilities, which can be triggered by specific requests (e.g., invalid offset type, parameter mismatch, invalid MySQL result resource, etc.). Remediation Temporary Fix: Disable error message display in php.ini by setting . Official Solution: None; the vendor showed no interest in coordinating patch release or security advisories. Example Requests and Responses Path Disclosure Vulnerability 1 Request: Response: Warning about illegal offset type. Path Disclosure Vulnerability 2 Request: Response: Warning about expected string parameter. Path Disclosure Vulnerability 3 Request: Response: Fatal error about unsupported operation type. Path Disclosure Vulnerability 4 Request: Response: Error about calling undefined function. Additional Information Test Case ID: TC 17968 Affected System: Calendarix version 0.7. 20070307 Vendor: Vincent Hor (Calendarix Enterprise) Discoverer: Jesper Jurcenoks

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2007-3259 Calendarix Multiple Path Disclosure Vulnerability Advisory