Description

webcalendar has a feature to add event and display the location of it. This feature lead to stored xss everytime a user open the calendar or the event detail page.

Proof of Concept

1. 1- login as user
2. 2- create an event
3. 3- insert the payload on “location” field
4. 4- Save
5. 5- Go back to the calendar
6. 6- XSS

#PAYLOAD

"><svg><animatetransform onbegin=alert(document.cookie)>