Home » Hacking News » PostCalendar 3.0 Cross Site Scripting Vulnerability

PostCalendar 3.0 Cross Site Scripting Vulnerability

by Nikola Strahija on April 22nd, 2002 PostCalendar 3.0 is a module for PHP-Nuke that provides an interactive events calendar that users can add entries to. Under certain conditions it fails to strip HTML or Script from user supplied data, allowing malicious code to be injected into event listings by users.

This is accomplished by submitted a normal plain-text event (as a logged in user), proceeding to the preview screen and added the HTML or script from there.


Remote: Yes

Exploit: NO exploit

From the forum

The forums are now OPEN AGAIN!

Xatrix.org © Copyright 2001-2016, Xatrix Security . All Rights Reserved
There are a thousand hacking at the branches of evil to one who is striking at the root. - Henry David Thoreau