PHP-Calendar "description" and "lastaction" Cross Site Scripting Vulnerabilities May 21 2010 08:20AM
VUPEN Web Security (advisories vupen com)
PHP-Calendar "description" and "lastaction" Cross Site Scripting
Vulnerabilities

I. BACKGROUND
---------------------

"PHP-Calendar is a simple web calendar. It is targeted towards groups that
need to collaboratively create and track events. In that same collaborative
spirit, the source for PHP-Calendar is available under an open source
license
for anyone to use and modify." from php-calendar.com

II. VULNERABILITIES
---------------------

VUPEN Web Vulnerability Research Team discovered two vulnerabilities in
PHP-Calendar.

These issues are caused by input validation errors when processing the
"description" or "lastaction" parameter, which could be exploited by
attackers to cause arbitrary scripting code to be executed by the user's
browser in the security context of an affected Web site.

III. AFFECTED PRODUCTS
---------------------------

PHP-Calendar version 2.0 Beta6 and prior

IV. SOLUTION
----------------

Upgrade to PHP-Calendar version 2.0 Beta7

V. CREDIT
--------------

These vulnerabilities were discovered by Mohammed Boumediane (VUPEN
Security)
with help of the VUPEN Web Application Security Scanning (WASS) technology.

VI. VUPEN Web Application Security Scanner (WASS)
----------------------------------------------------

VUPEN Web Application Security Scanner (WASS) is a SaaS security scanning
technology which enables corporations and organizations to identify, track
and remediate security vulnerabilities affecting their web sites and
web applications, prevent criminals from gaining unauthorized access to
sensitive data, and comply with security requirements such as PCI.

VUPEN WASS is based on a proprietary technology developed by VUPEN security
experts, and combines black-box (smart and automated) and grey-box
(signature-based) scanning to accurately identify web vulnerabilities such
as those in the OWASP Top 10 including SQL injection and cross-site
scripting,
but also real-world vulnerabilities such as shell command injection and
file inclusion.

Read More: http://www.vupen.com/english/wass/

VII. REFERENCES
----------------------

http://www.vupen.com/english/advisories/2010/1202
http://php-calendar.blogspot.com/2010/05/php-calendar-20-beta7.html

VIII. DISCLOSURE TIMELINE
-----------------------------

2010-04-21 - Vendor notified
2010-05-21 - Coordinated public Disclosure

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus