Springshare LibCal 2.0 Cross Site Scripting

`*Exploit Title: Springshare LibCal XSS (Cross-Site Scripting) Vulnerability*  
  
Product: LibCal  
  
Vendor: Springshare  
  
Vulnerable Versions: 2.0  
  
Tested Version: 2.0  
  
Advisory Publication: Nov 25, 2014  
  
Latest Update: Nov 25, 2014  
  
Vulnerability Type: Cross-Site Scripting [CWE-79]  
  
CVE Reference: CVE-2014-7291  
  
CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)  
  
Impact Subscore: 2.9  
  
Exploitability Subscore: 8.6  
  
Solution Status: Fixed by Vendor  
  
Credit: Wang Jing [SPMS, Nanyang Technological University, Singapore]  
  
  
  
  
  
  
  
*Advisory Details*  
  
  
  
*(1) Product:*  
  
"Springshare LibCal is an easy to use calendaring and event management  
platform for libraries. Used by 1,600+ libraries worldwide."  
  
  
  
*(2) Vulnerability Details:*  
  
The XSS vulnerabilities occur at "/api_events.php?" page, with "&m" and  
"&cid" parameters.  
  
  
  
*(3) Solutions:*  
  
2014-10-01: Report vulnerability to Vendor  
  
2014-10-15: Vendor replied with thanks and vendor changed the source code  
  
  
  
  
  
  
  
  
  
*References:*  
  
http://tetraph.com/security/cves/cve-2014-7291-springshare-libcal-xss-cross-site-scripting-vulnerability/  
  
http://www.springshare.com/libcal/  
  
http://cwe.mitre.org  
  
http://cve.mitre.org/  
  
  
`