Perl cal XSS Vulnerability

[Sumit Siddharth <sumit.siddharth () gmail com>]

Vendor: Perl-Cal

Version tested: Perl-Cal 2.99.20 , other versions may also be affected.

Type: Cross Site Scripting

Severity: Medium

Vulnerability discovered:- 23rd Nov 2005

Date released:-8 dec 2005

Vulnerability Type: Input Validation Error

Overview:- PerlCal is a CGI script written by Acme Software that allows
web-based calendar sharing and related functions.There exists a cross-site
scripting vulnerability as the input in one of the parameters(p0) is not
filtered correctly.

Description:- The cross-site scripting bug can be executed with a URL like
so:

http://localhost/cgi-bin/perlcal/cal_make.pl
?p0=%3Cscript%3Ealert('hi');%3C/script%3E

This issue could permit a remote attacker to create a malicious URL link
that includes hostile HTML and script code. If this link were to be
followed, the hostile code may be rendered in the web browser of the victim
user. This would occur in the security context of the affected Web site.

Demonstration:- http://localhost/cgi-bin/perlcal/cal_make.pl
?p0=%3Cscript%3Ewindow.open('http://www.google.com&apos;);%3Cscript%3E<http://www.google.com%27%29;%3Cscript%3E>

Other attacks:-
http://localhost/cgi-bin/perlcal/cal_make.pl
?p0=%3Cscript%3Ealert(document.cookie);</script>

Solution:
--------------------
Vendor has released a patch.

Credits:- $um$id

Sumit

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/