LuxCal Web Calendar Missing Authentication Vulnerability in Dloader.php Allowing Arbitrary File Access

A missing authentication vulnerability has been identified in the LuxCal Web Calendar, specifically in versions prior to 5.3.3M (MySQL) and prior to 5.3.3L (SQLite). The vulnerability resides in the dloader.php script, where authentication is not properly enforced. Exploiting this vulnerability could allow unauthorized access to arbitrary files on the server.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the server.

Remediation

Users are advised to update LuxCal Web Calendar to version 5.3.3 or later. The latest version can be downloaded from the LuxCal website.