WebCalendar month.php eventinfo XSS

2003-09-04T09:31:48
ID OSVDB:3623
Type osvdb
Reporter OSVDB
Modified 2003-09-04T09:31:48

Description

Vulnerability Description

WebCalendar contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the "eventinfo" variable upon submission to the month.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

Solution Description

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Short Description

WebCalendar contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the "eventinfo" variable upon submission to the month.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

Manual Testing Notes

http://www.host.name/webcalendar/month.php?eventinfo=<script>alert(document.cookie)</script>

References:

Vendor URL: http://webcalendar.sourceforge.net/ Secunia Advisory ID:9672 Other Advisory URL: http://nocon.darkflame.net/CSS/Wecalendar.txt Other Advisory URL: http://archives.neohapsis.com/archives/bugtraq/2003-09/0051.html ISS X-Force ID: 13094 Bugtraq ID: 8539