apply.drew.edu XSS vulnerability

Vulnerable URL: https://apply.drew.edu/admissions/lookupuser.php?jsonp-callback=prompt'OPENBUGBOUNTY'...

PT-2007-2302 · Local · Local Calendar System

Name of the Vulnerable Software and Affected Versions: local Calendar System version 1.1 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the TEMPLATE DIR parameter to files such as showinvoices.php, showmonth.php, showevents.php, retrieveinvoice.php,...