PHP Event Calendar Index.PHP Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	20001
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 13 2006 12:00AM
Updated:	Sep 14 2006 05:37PM
Credit:	NR Nandini of OS2A is credited with the discovery of these vulnerabilities.
Vulnerable:	PHP Event Calendar PHP Event Calendar 1.5.1 PHP Event Calendar PHP Event Calendar 1.5 PHP Event Calendar PHP Event Calendar 1.4
Not Vulnerable:

PHP Event Calendar Index.PHP Multiple Cross Site Scripting Vulnerabilities

PHP Event Calendar is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials and to launch other attacks.

Version 1.5.1 is vulnerable; other versions may also be affected.

PHP Event Calendar Index.PHP Multiple Cross Site Scripting Vulnerabilities

An attacker can exploit this vulnerability via a web client.

The following proof-of-concept URI is available:

• /data/vulnerabilities/exploits/20001.html

PHP Event Calendar Index.PHP Multiple Cross Site Scripting Vulnerabilities

Solution:
The vendor has released a fix to address this issue. Please contact the vendor for information on how to obtain and apply this fix.

PHP Event Calendar Index.PHP Multiple Cross Site Scripting Vulnerabilities

References:

• PHP Event Calendar (PHP Event Calendar)
  
• PHP Event Calendar Multiple Parameter Cross Site Scripting Vulnerability (OS2A BTO)