PHPCalendars Multi Vulnerability

vendor:

PHPCalendars

by:

LionTurk

7,5

CVSS

HIGH

XSS

CWE

Product Name: PHPCalendars

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

PHPCalendars Multi Vulnerability

The PHPCalendars script is vulnerable to XSS via the 'cat' parameter in the product_list.php file. An attacker can inject malicious JavaScript code into the 'cat' parameter, which will be executed in the browser of the victim when the page is loaded.

Mitigation:

Input validation should be used to prevent XSS attacks.

Source

Exploit-DB raw data:

==============================================================================  

                      _      _       _          _      _   _  

                     / \    | |     | |        / \    | | | |  

                    / _ \   | |     | |       / _ \   | |_| |  

                   / ___ \  | |___  | |___   / ___ \  |  _  |  

                  /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|  

   

   

==============================================================================  

        [»] ~ Note : Forever RevengeHack.Com-Ar-Ge.Org Acildi

==============================================================================  

        [»] PHPCalendars  Multi Vulnerability 

==============================================================================  

   

    [»] Script:             [  PHPCalendars  ]  

    [»] Language:           [ PHP ]  

    [»] Download:           [ http://scripti.org/script_calendarstore-alisveris-scripti_1256_21.html] 

    [»] Founder:            [ LionTurk -  Bylionturk@kafam1milyon.com & LionTurk.Turkblog.com }

    [»] My Home:            [ RevengeHack.com and Ar-ge.Org ]  

    [»]N0T3    :             Yeni Aciklarimi Bekleyin.


###########################################################################  

   

===[ Exploit And Dork  ]===  

   

  [»] http://server/[dizin]/product_list.php?cat=1[XSS-Vuln] 
  [»] http://server/[dizin]/install.php


 


  [»] Powered by the PHPCalendars Script
 




Author:  LionTurk <-  

Bizim Asiret: eXceptioN,CodeInside,CristaL1o,Hack3ra,eXtReMe,By_HKC,TerrorZveng

                 

- Ben Ne Heykirlar Gordum  site heyklicek exploiti yok.Ben Ne exploitler gordum kullancak heykir yok :D
            Kisisel Blogum:LionTurk.Turkblog.com

                                 


###########################################################################