PT-2009-2487 · Nashtech · Nashtech Easy Php Calendar

Published 2009-08-21 · Updated 2017-08-17 · CVE-2008-7018

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions NashTech Easy PHP Calendar version 6.3.25

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the descr parameter in the Details field of an Add New Event action. This occurs in an unspecified request generated by an add action in index.php.

Recommendations For NashTech Easy PHP Calendar version 6.3.25, consider validating and sanitizing user input for the descr parameter to prevent XSS attacks. As a temporary workaround, restrict access to the Add New Event action in index.php to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-7018

Affected Products

Nashtech Easy Php Calendar

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2008-7018 · Security Note
• http://securityfocus.com/bid/31478 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45517 · Note
• http://securityfocus.com/archive/1/496796 · Note