PT-2021-23510 · Unknown · Phpeventcalendar

Erik Steltzner + 1 · Published 2021-11-05 · Updated 2021-11-09 · CVE-2021-42078

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHP Event Calendar through 2021-11-04

Description The issue allows for persistent cross-site scripting (XSS) and can be exploited by an adversary in multiple ways, such as performing actions on the page in the context of other users or defacing the site. This is demonstrated by the /server/ajax/events manager.php API endpoint, specifically the title parameter.

Recommendations For PHP Event Calendar through 2021-11-04, consider disabling the /server/ajax/events manager.php API endpoint or restricting access to the title parameter until a patch is available. As a temporary workaround, avoid using the title parameter in the affected API endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-42078

Affected Products

Phpeventcalendar

References · 6

• 🔥 https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-049.txt · Exploit
• 🔥 http://seclists.org/fulldisclosure/2021/Nov/24 · Exploit
• https://osv.dev/vulnerability/CVE-2021-42078 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42078 · Security Note
• https://t.me/defcon_news/89281 · Telegram Post
• https://t.me/cibsecurity/31954 · Telegram Post