WebCalendar

Is this line correct?

From what I know of PHP a include line is used to include files that have functions that will be called by the current file.

If that is the case, why is a variable being listed as a include?

I found at least part of it.

It seems that WebCalendar makes strong use of Global variables. There are a number of nasty exploits out there for this.

As a result almost everyone has quit using them.
The way this came up is our security guy found that he could define $user_inc as anything he wanted to from the URL. As a result he could do nasty things like copy our username password file.

Please tell me there is a easy fix. As it stands I am about to have to go back in and rewrite a ton of code so I can switch off global

I just posted a fix for the $user_inc vulnerability. (Actually, I'm surprised no one has pointed this one out before since it's such a huge security hole.)

I'd certainly like to completely remove the global variables from all the code. No one has gotten around to doing this yet... Any volunteers?

I have found a few security problems with webcaladar. They may be all related to all the global variables but i don't know for sure. I would like to contact someone directly about these. Who should i contact ?

actually to add to my previous post, now that this is made public, your online demo is vulerable to this as well.

actually, now that this is public, THe online demo is vulnerable to this.

sorry for the double post :)

This has been posted to the Full Disclosure mailing list now so you should fix it asap :)

The demo has been updated with the latest CVS code to address this security issue.

Maybe next time the author can be given adequate time to release a new version or patch before this is posted on bugtraq.

-- Jeff

This wasn't a problem before the register globals hack was put in (0.9.39). Why? config.php set $user_inc. It still does, however the register globals hack overwrites it.

-- Jeff

Jeff,

Correct me if i am wrong but,

1: It looks like the problem was made "public" in this forum before the bugtraq/fd postings.

2: Craig Knudsen says he had already posted a fix
on 2003-07-15.

Is this not the case ?