vendor:
Web Calendar System v 3.22/3.40/3.05/3.23
by:
blackbeard-sql
8.8
CVSS
HIGH
XSS + remote bypass Exploit+Remote SQL Injection
79, 89, 564
CWE
Product Name: Web Calendar System v 3.22/3.40/3.05/3.23
Affected Version From: 3.22
Affected Version To: 3.23
Patch Exists: NO
Related CWE: N/A
CPE: a:web_calendar_system:web_calendar_system_v3.22
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2020
Multiple Exploits in Web Calendar System v 3.22/3.40/3.05/3.23
The Web Calendar System v 3.22/3.40/3.05/3.23 is vulnerable to multiple exploits such as XSS, remote bypass exploit and remote SQL injection. An attacker can exploit these vulnerabilities by sending a malicious payload in the form of a POST request to the vulnerable website. The payload can be used to bypass authentication and gain access to the website. Additionally, an attacker can use the payload to inject malicious code into the website, which can be used to steal sensitive information such as cookies.
Mitigation:
The website should be secured by implementing proper authentication and authorization mechanisms. Additionally, input validation should be implemented to prevent malicious payloads from being injected into the website.
