Spiffy Calendar < 4.9.9 - Broken Access Control

2024-02-0200:00:00

cyc707

139

spiffy calendar

broken access control

contributor+ account

proxy interceptor

burp suite

event creation

parameter change

admin id exploit

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

Description The plugin doesn’t check the event_author parameter, and allows any user to alter it when creating an event, leading to deceiving users/admins that a page was created by a Contributor+.

Using a Contributor+ account and a proxy interceptor such as Burp Suite, create an event.
Change the event_location parameter name in the request to event_author, and feed it an ID of an admin (example ID 1).
Submit the request, and the event will be created, reflecting that it was created by X admin (the username of the ID used in step 2).