CVE-2004-1423

CVE-2004-1423 describes multiple remote file inclusion vulnerabilities in PHP-Calendar before version 0.10.1, affecting products like the Commonwealth of Massachusetts Virtual Law Office. Attackers can exploit this by injecting a URL into the phpc_root_path parameter of includes/calendar.php or includes/setup.php, leading to arbitrary PHP code execution. With a CVSS score of 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P), this vulnerability is easily exploitable over the network with no authentication required, potentially resulting in full compromise of confidentiality, integrity, and availability. While not listed on CISA KEV, exploit code is publicly available via ExploitDB, and it has garnered significant community discussion, indicating a high potential for exploitation.