EasyPHPCalender script XSS

2013-04-14 / 2013-04-21

Credit: Anant

Risk: Low

Local: No

Remote: Yes

CVE: CVE-2013-1955

CWE: CWE-79

CVSS Base Score: 4.3/10

Impact Subscore: 2.9/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: None

Integrity impact: Partial

Availability impact: None

http://www.easyphpcalendar.com/forums/showthread.php?p=45554#post45554

technical details are not issued however the two issues are pertaining to
XSS in following two files in the package.

index.php
datePicker.php

This issue affect both free version i.e. version 6.
as well as commerical version < 7.0.13

Changelog visible here for v7 :
http://docs7.easyphpcalendar.com/source/ChangeLog/changeLog.htm
for v6 patch is listed here :http://www.easyphpcalendar.com/v6download.php
 as  Security Patch - Released April 9,
2013<http://www.easyphpcalendar.com/files/EPC6Patch.zip>

Thanks in advance.

-Anant

References:

http://www.easyphpcalendar.com/forums/showthread.php?p=45554#post45554

http://www.easyphpcalendar.com/files/EPC6Patch.zip

http://seclists.org/oss-sec/2013/q2/index.html

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

EasyPHPCalender script XSS

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.