PT-2021-17399 · Unknown · Triconsole Datepicker Calendar

Akash Chathoth · Published 2021-02-25 · Updated 2021-03-03 · CVE-2021-27330

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Triconsole Datepicker Calendar versions prior to 3.77

Description The issue affects the calendar form.php file, allowing attackers to perform cross-site scripting (XSS) attacks. This can lead to the reading of authentication cookies that are still active. As a result, attackers can perform further attacks, such as reading browser history, directory listings, and file contents.

Recommendations For versions prior to 3.77, update to version 3.77 or later to resolve the issue. As a temporary workaround, consider restricting access to the calendar form.php file to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-27330

Affected Products

Triconsole Datepicker Calendar

References · 7

• 🔥 https://exploit-db.com/exploits/49597 · Exploit
• 🔥 http://packetstormsecurity.com/files/161570/Triconsole-3.75-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-27330 · Security Note
• https://osv.dev/vulnerability/CVE-2021-27330 · Vendor Advisory
• http://triconsole.com/php/calendar_datepicker.php · Note
• https://t.me/cibsecurity/24135 · Telegram Post
• http://triconsole.com · Note