Bugtraq mailing list archives
PHP-Calendar "description" and "lastaction" Cross Site Scripting Vulnerabilities
From: "VUPEN Web Security" <advisories () vupen com>
Date: Fri, 21 May 2010 10:20:35 +0200
PHP-Calendar "description" and "lastaction" Cross Site Scripting Vulnerabilities
I. BACKGROUND --------------------- "PHP-Calendar is a simple web calendar. It is targeted towards groups that need to collaboratively create and track events. In that same collaborativespirit, the source for PHP-Calendar is available under an open source license
for anyone to use and modify." from php-calendar.com II. VULNERABILITIES --------------------- VUPEN Web Vulnerability Research Team discovered two vulnerabilities in PHP-Calendar. These issues are caused by input validation errors when processing the "description" or "lastaction" parameter, which could be exploited by attackers to cause arbitrary scripting code to be executed by the user's browser in the security context of an affected Web site. III. AFFECTED PRODUCTS --------------------------- PHP-Calendar version 2.0 Beta6 and prior IV. SOLUTION ---------------- Upgrade to PHP-Calendar version 2.0 Beta7 V. CREDIT --------------These vulnerabilities were discovered by Mohammed Boumediane (VUPEN Security)
with help of the VUPEN Web Application Security Scanning (WASS) technology. VI. VUPEN Web Application Security Scanner (WASS) ---------------------------------------------------- VUPEN Web Application Security Scanner (WASS) is a SaaS security scanning technology which enables corporations and organizations to identify, track and remediate security vulnerabilities affecting their web sites and web applications, prevent criminals from gaining unauthorized access to sensitive data, and comply with security requirements such as PCI. VUPEN WASS is based on a proprietary technology developed by VUPEN security experts, and combines black-box (smart and automated) and grey-box (signature-based) scanning to accurately identify web vulnerabilities suchas those in the OWASP Top 10 including SQL injection and cross-site scripting,
but also real-world vulnerabilities such as shell command injection and file inclusion. Read More: http://www.vupen.com/english/wass/ VII. REFERENCES ---------------------- http://www.vupen.com/english/advisories/2010/1202 http://php-calendar.blogspot.com/2010/05/php-calendar-20-beta7.html VIII. DISCLOSURE TIMELINE ----------------------------- 2010-04-21 - Vendor notified 2010-05-21 - Coordinated public Disclosure
Current thread:
- PHP-Calendar "description" and "lastaction" Cross Site Scripting Vulnerabilities VUPEN Web Security (May 21)