DATABASE RESOURCES PRICING ABOUT US

{"id": "PACKETSTORM:42250", "type": "packetstorm", "bulletinFamily": "exploit", "title": "perl-cal-29920.txt", "description": "", "published": "2005-12-14T00:00:00", "modified": "2005-12-14T00:00:00", "cvss": {"vector": "NONE", "score": 0.0}, "href": "https://packetstormsecurity.com/files/42250/perl-cal-29920.txt.html", "reporter": "Sumit Siddharth", "references": [], "cvelist": [], "lastseen": "2016-11-03T10:20:22", "viewCount": 10, "enchantments": {"score": {"value": -0.1, "vector": "NONE"}, "dependencies": {}, "backreferences": {}, "exploitation": null, "vulnersScore": -0.1}, "sourceHref": "https://packetstormsecurity.com/files/download/42250/perl-cal-29920.txt", "sourceData": "`------=_Part_17141_22617522.1134045408185 \nContent-Type: text/plain; charset=ISO-8859-1 \nContent-Transfer-Encoding: quoted-printable \nContent-Disposition: inline \n \nVendor: Perl-Cal \n \nVersion tested: Perl-Cal 2.99.20 , other versions may also be affected. \n \nType: Cross Site Scripting \n \nSeverity: Medium \n \nVulnerability discovered:- 23rd Nov 2005 \n \nDate released:-8 dec 2005 \n \nVulnerability Type: Input Validation Error \n \nOverview:- PerlCal is a CGI script written by Acme Software that allows \nweb-based calendar sharing and related functions.There exists a cross-site \nscripting vulnerability as the input in one of the parameters(p0) is not \nfiltered correctly. \n \nDescription:- The cross-site scripting bug can be executed with a URL like \nso: \n \nhttp://localhost/cgi-bin/perlcal/cal_make.pl \n?p0=3D%3Cscript%3Ealert('hi');%3C/script%3E \n \nThis issue could permit a remote attacker to create a malicious URL link \nthat includes hostile HTML and script code. If this link were to be \nfollowed, the hostile code may be rendered in the web browser of the victim \nuser. This would occur in the security context of the affected Web site. \n \nDemonstration:- http://localhost/cgi-bin/perlcal/cal_make.pl \n?p0=3D%3Cscript%3Ewindow.open('http://www.google.com');%3Cscript%3E<http://= \nwww.google.com%27%29;%3Cscript%3E> \n \nOther attacks:- \nhttp://localhost/cgi-bin/perlcal/cal_make.pl \n?p0=3D%3Cscript%3Ealert(document.cookie);</script> \n \nSolution: \n-------------------- \nVendor has released a patch. \n \nCredits:- $um$id \n \nSumit \n \n------=_Part_17141_22617522.1134045408185 \nContent-Type: text/html; charset=ISO-8859-1 \nContent-Transfer-Encoding: quoted-printable \nContent-Disposition: inline \n \n<br> \nVendor: Perl-Cal<br> \n<br> \nVersion tested: Perl-Cal 2.99.20 , other versions may also be affected.<br> \n<br> \nType: Cross Site Scripting<br> \n<br> \nSeverity: Medium<br> \n<br> \nVulnerability discovered:- 23rd Nov 2005<br> \n<br> \nDate released:-8 dec 2005<br> \n<br> \nVulnerability Type: Input Validation Error<br> \n<br> \nOverview:- \nPerlCal is a CGI script written by Acme Software that allows web-based \ncalendar sharing and related functions.There exists a cross-site \nscripting vulnerability as the input in one of the parameters(p0) is not \nfiltered correctly.<br> \n<br> \nDescription:- The cross-site scripting bug can be executed with a URL like = \nso:<br> \n<br> \n<a href=3D\"http://localhost/cgi-bin/perlcal/cal_make.pl\" target=3D\"_blank\" = \nonclick=3D\"return top.js.OpenExtLink(window,event,this)\">http://localhost/c= \ngi-bin/perlcal/cal_make.pl</a><br> \n?p0=3D%3Cscript%3Ealert('hi');%3C/script%3E<br> \n<br> \nThis \nissue could permit a remote attacker to create a malicious URL link \nthat includes hostile HTML and script code. If this link were to be \nfollowed, the hostile code may be rendered in the web browser of the \nvictim user. This would occur in the security context of the affected \nWeb site.<br> \n<br> \nDemonstration:- <a href=3D\"http://localhost/cgi-bin/perlcal/cal_make.pl\" ta= \nrget=3D\"_blank\" onclick=3D\"return top.js.OpenExtLink(window,event,this)\">ht= \ntp://localhost/cgi-bin/perlcal/cal_make.pl</a><br> \n?p0=3D%3Cscript%3Ewindow.open('<a href=3D\"http://www.google.com%27%29;%3Csc= \nript%3E\" target=3D\"_blank\" onclick=3D\"return top.js.OpenExtLink(window,even= \nt,this)\">http://www.google.com');%3Cscript%3E</a><br> \n<br>Other attacks:-<br> \n<a href=3D\"http://localhost/cgi-bin/perlcal/cal_make.pl\" target=3D\"_blank\" = \nonclick=3D\"return top.js.OpenExtLink(window,event,this)\">http://localhost/c= \ngi-bin/perlcal/cal_make.pl</a><br> \n \n?p0=3D%3Cscript%3Ealert(document.cookie);</script><br> \n<br> \nSolution:<br> \n--------------------<br> \nVendor has released a patch.<br> \n<br> \nCredits:- $um$id<br> \n<br> \nSumit<br> \n \n \n \n \n \n------=_Part_17141_22617522.1134045408185-- \n`\n", "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1646877729}}

{}