PHP Event Calendar Multiple Parameter Cross Site Scripting Vulnerability
OS2A ID: OS2A_1007 Status: 08/20/2006 Issue Discovered 09/06/2006 Reported to the Vendor 09/09/2006 Fixed by Vendor 09/13/2006 Advisory Released
Class: Cross Site Scripting Severity: Low
PHP Event Calendar is a reusable PHP script that extends a web site's functionality with an event scheduler and/or news archive. http://www.softcomplex.com/products/php_event_calendar/
A cross-site scripting vulnerability exists in PHP Event Calendar, due to input validation error in parameters tilte(ti), body(bi) and backgroung Image(cbgi) in cl_files/index.php page when adding a new event.
Successful exploitation requires authentication.
An authenticated remote attacker could inject malicious HTML and script code in other user's browser session within the security context of the affected site.
PHP Event Calendar 1.5.1 (prior versions may also be vulnerable)
http://www.yoursite.com/directory_where_you_installed_php_event_calendar/cl_files/index.php Vulnerable fields: title field - ti body field - bi Backgroung Image - cbgi
Insert "<script>alert('XSS Vulnerable');</script>" in above field and click "Add event".
ACCESS_VECTOR = REMOTE ACCESS_COMPLEXITY = LOW AUTHENTICATION = REQUIRED CONFIDENTIALITY_IMPACT = NONE INTEGRITY_IMPACT = PARTIAL AVAILABILITY_IMPACT = NONE IMPACT_BIAS = INTEGRITY EXPLOITABILITY = PROOF_OF_CONCEPT REMEDIATION_LEVEL = OFFICIAL_FIX REPORT_CONFIDENCE = CONFIRMED CVSS Base Score = 2.1 (AV:R/AC:L/Au:R/C:N/I:P/A:N/B:I) CVSS Temporal Score = 1.6 Risk factor = Low
"Attached is the version that blocks the use of the <script> in the text of the event. We can't block use of HTML completely because many users want to be able to use HTML for the event descriptions. The events are managed in the password protected control panel so there was no security threat even before the change was applied."
Update to the fixed version, http://www.softcomplex.com/products/php_event_calendar/
NR Nandini of OS2A has been credited with the discovery of this vulnerability.