full-disclosure - Perl cal XSS Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <489d2f300512080436i56d1fa8sf82e1236280e3905@mail.gmail.com>
Date: Thu Dec  8 12:36:56 2005
From: sumit.siddharth at gmail.com (Sumit Siddharth)
Subject: Perl cal XSS Vulnerability

Vendor: Perl-Cal

Version tested: Perl-Cal 2.99.20 , other versions may also be affected.

Type: Cross Site Scripting

Severity: Medium

Vulnerability discovered:- 23rd Nov 2005

Date released:-8 dec 2005

Vulnerability Type: Input Validation Error

Overview:- PerlCal is a CGI script written by Acme Software that allows
web-based calendar sharing and related functions.There exists a cross-site
scripting vulnerability as the input in one of the parameters(p0) is not
filtered correctly.

Description:- The cross-site scripting bug can be executed with a URL like
so:

http://localhost/cgi-bin/perlcal/cal_make.pl
?p0=%3Cscript%3Ealert('hi');%3C/script%3E

This issue could permit a remote attacker to create a malicious URL link
that includes hostile HTML and script code. If this link were to be
followed, the hostile code may be rendered in the web browser of the victim
user. This would occur in the security context of the affected Web site.

Demonstration:- http://localhost/cgi-bin/perlcal/cal_make.pl
?p0=%3Cscript%3Ewindow.open('http://www.google.com');%3Cscript%3E<http://www.google.com%27%29;%3Cscript%3E>

Other attacks:-
http://localhost/cgi-bin/perlcal/cal_make.pl
?p0=%3Cscript%3Ealert(document.cookie);</script>

Solution:
--------------------
Vendor has released a patch.

Credits:- $um$id

Sumit
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20051208/ffd8366d/attachment.html