Description
A vulnerability was identified in sproctor php-calendar up to 2.0.13. This impacts an unknown function of the file index.php. Such manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be launched remotely. The name of the patch is a2941109b42201c19733127ced763e270a357809. It is advisable to implement a patch to correct this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sproctor | php-calendar | 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13 | — |
References
- VDB-215445 | sproctor php-calendar index.php cross site scripting vdb-entry technical-description
- VDB-215445 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- https://github.com/sproctor/php-calendar/commit/a2941109b42201c19733127ced763e270a357809 patch