[ml] PHP iCalendar CSS

vi potreste chiedere: ma perche' posti qui? beh perche' siamo troppo
l33t e sikurezza.org viene prima dei vendor : ) koba ha fixato quindi
la query giusta da fare a google e'

"Powered by PHP iCalendar" -site:sikurezza.org

(ovviamente scherzo, lo so che siamo tutti white hat, giusto?)

PHP iCalendar is vulnerable to Cross Site Scripting cause of a wrong
input validation in index.php and will include an arbitrary file ending
with .php.

Se siete italiani leggete adv.txt e tra le bestemmie troverete di sicuro
maggiori informazioni.

www.ush.it/2005/10/25/php-icalendar-CSS/
www.ush.it/team/ascii/hack-PHP-iCalendar/adv.txt
www.ush.it/team/ascii/hack-PHP-iCalendar/advisory.txt

-------- Original Message --------
Subject: PHP iCalendar CSS
Date: Tue, 25 Oct 2005 03:32:02 +0200
From: ascii <ascii@xxxxxxxxxxxx>
To: chad@xxxxxxxxxxxxxxx

hi, on 20051023 i have found a css (cross site) in your script

now i'm going to disc on an italian ml, but the fix
is small and easy so your response will be fast : )

http://www.ush.it/2005/10/25/php-icalendar-css/

if u can handle the work to submit to cve i would appreciate

when you are ready i'll disc on full-disclosure/vulnwatch/bugtraq
(with your response and the cve magic number)

ok, see you, ascii