PHP-Calendar 'description' and 'lastaction' Cross Site Scripting Vulnerabilities

  1. Network Vulnerabilities
  2. Web application abuses
  3. PHP-Calendar 'description' and 'lastaction' Cross Site Scripting Vulnerabilities
Summary
This host is running PHP Calendar and is prone to Cross Site Scripting vulnerabilites.
Impact
Successful exploitation will allow attacker to execute arbitrary script code. Impact level: Application
Solution
Upgrade PHP-Calendar to 2.0 Beta7 or later, http://code.google.com/p/php-calendar/downloads/list
Insight
The flaws are due to input validation errors when processing the 'description' and 'lastaction' parameters.
Affected
PHP-Calendar version 2.0 Beta6 and prior on all platforms.
References
Updated on 2015-03-25
Severity
Medium Severity
Classification
Related Vulnerabilities