CVE-2012-5385

CVE-2012-5385 describes a critical vulnerability in WebCalendar versions prior to 1.2.5, where the install/index.php script allows unauthenticated remote attackers to modify settings.php. This flaw, stemming from improper handling of user theme preferences, could lead to arbitrary code execution. With a CVSS score of 7.5, it represents a high-severity risk due to its network-based attack vector and low attack complexity, potentially resulting in partial confidentiality, integrity, and availability compromise. While no active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion has been observed, the potential for arbitrary code execution warrants attention.