CVE-2005-3571 in PHPCalendar
Summary
by MITRE
PHP file inclusion vulnerability in protection.php in CodeGrrl (a) PHPCalendar 1.0, (b) PHPClique 1.0, (c) PHPCurrently 2.0, (d) PHPFanBase 2.1, and (e) PHPQuotes 1.0 allows remote attackers to include arbitrary local files via the siteurl parameter when register_globals is enabled. NOTE: It was later reported that PHPFanBase 2.2 is also affected.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/29/2025
This vulnerability represents a critical server-side include flaw that affects multiple PHP-based web applications including PHPCalendar, PHPClique, PHPCurrently, PHPFanBase, and PHPQuotes. The issue stems from improper input validation in the protection.php script where the siteurl parameter is directly incorporated into file inclusion operations without adequate sanitization. When register_globals is enabled on the target server, this creates a pathway for remote attackers to manipulate the application's behavior by injecting malicious file paths through the vulnerable parameter.
The technical exploitation occurs because the application fails to properly validate or sanitize user-supplied input before using it in file inclusion contexts. This vulnerability directly maps to CWE-98, which describes improper file inclusion vulnerabilities where attacker-controlled input is used to determine which files to include. The flaw is particularly dangerous because it leverages the register_globals configuration setting, which when enabled allows external parameters to be automatically imported into the global namespace, effectively bypassing normal input validation mechanisms.
The operational impact of this vulnerability is severe as it enables attackers to perform local file inclusion attacks that can lead to arbitrary code execution, data theft, or complete system compromise. Attackers can leverage this vulnerability to include system files such as /etc/passwd, execute malicious code through uploaded files, or gain unauthorized access to sensitive application data. The vulnerability affects multiple applications within the same codebase, indicating a systemic design flaw that requires comprehensive remediation across affected products.
Mitigation strategies should focus on disabling register_globals in php.ini configuration, implementing proper input validation and sanitization for all user-supplied parameters, and employing secure file inclusion practices that utilize whitelisting or strict path validation. Organizations should also consider implementing web application firewalls to detect and block suspicious file inclusion patterns. The vulnerability demonstrates the critical importance of following secure coding practices as outlined in the OWASP Top Ten and aligns with ATT&CK technique T1059 for command and script injection, emphasizing the need for robust input validation and proper access control mechanisms to prevent unauthorized file operations.