SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Calendar)  >   PerlCal Vendors:   Acme Software
PerlCal Input Validation Error in 'p0' Parameter Lets Remote Users Conduct Cross-Site Scripting Attacks
SecurityTracker Alert ID:  1015332
SecurityTracker URL:  http://securitytracker.com/id/1015332
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Dec 8 2005
Impact:   Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
Exploit Included:  Yes  
Version(s): 2.99i20
Description:   A vulnerability was reported in PerlCal. A remote user can conduct cross-site scripting attacks.

The 'cal_make.pl' script does not properly filter HTML code from user-supplied input in the p0 parameter before displaying the input. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the PerlCal software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

A demonstration exploit URL is provided:

http://[target]/cgi-bin/perlcal/cal_make.pl?p0=3D%3Cscript%3Ealert('hi');%3C/script%3E

Sumit Siddharth reported this vulnerability.

Impact:   A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the PerlCal software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
Solution:   The vendor has issued a patch.
Vendor URL:  www.perlcal.com/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  [Full-disclosure] Perl cal XSS Vulnerability

--===============1929596508==
Content-Type: multipart/alternative; 
	boundary="----=_Part_17141_22617522.1134045408185"

------=_Part_17141_22617522.1134045408185
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Vendor: Perl-Cal

Version tested: Perl-Cal 2.99.20 , other versions may also be affected.

Type: Cross Site Scripting

Severity: Medium

Vulnerability discovered:- 23rd Nov 2005

Date released:-8 dec 2005

Vulnerability Type: Input Validation Error

Overview:- PerlCal is a CGI script written by Acme Software that allows
web-based calendar sharing and related functions.There exists a cross-site
scripting vulnerability as the input in one of the parameters(p0) is not
filtered correctly.

Description:- The cross-site scripting bug can be executed with a URL like
so:

http://localhost/cgi-bin/perlcal/cal_make.pl
?p0=3D%3Cscript%3Ealert('hi');%3C/script%3E

This issue could permit a remote attacker to create a malicious URL link
that includes hostile HTML and script code. If this link were to be
followed, the hostile code may be rendered in the web browser of the victim
user. This would occur in the security context of the affected Web site.

Demonstration:- http://localhost/cgi-bin/perlcal/cal_make.pl
?p0=3D%3Cscript%3Ewindow.open('http://www.google.com');%3Cscript%3E<http://=
www.google.com%27%29;%3Cscript%3E>

Other attacks:-
http://localhost/cgi-bin/perlcal/cal_make.pl
?p0=3D%3Cscript%3Ealert(document.cookie);</script>

Solution:
--------------------
Vendor has released a patch.

Credits:- $um$id

Sumit

------=_Part_17141_22617522.1134045408185
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

<br>
Vendor: Perl-Cal<br>
<br>
Version tested: Perl-Cal 2.99.20 , other versions may also be affected.<br>
<br>
Type: Cross Site Scripting<br>
<br>
Severity: Medium<br>
<br>
Vulnerability discovered:- 23rd Nov 2005<br>
<br>
Date released:-8 dec 2005<br>
<br>
Vulnerability Type: Input Validation Error<br>
<br>
Overview:-
PerlCal is a CGI script written by Acme Software that allows web-based
calendar sharing and related functions.There exists a cross-site
scripting vulnerability as the input in one of the parameters(p0) is not
filtered correctly.<br>
<br>
Description:- The cross-site scripting bug can be executed with a URL like =
so:<br>
<br>
<a href=3D"http://localhost/cgi-bin/perlcal/cal_make.pl" target=3D"_blank" =
onclick=3D"return top.js.OpenExtLink(window,event,this)">http://localhost/c=
gi-bin/perlcal/cal_make.pl</a><br>
?p0=3D%3Cscript%3Ealert('hi');%3C/script%3E<br>
<br>
This
issue could permit a remote attacker to create a malicious URL link
that includes hostile HTML and script code. If this link were to be
followed, the hostile code may be rendered in the web browser of the
victim user. This would occur in the security context of the affected
Web site.<br>
<br>
Demonstration:- <a href=3D"http://localhost/cgi-bin/perlcal/cal_make.pl" ta=
rget=3D"_blank" onclick=3D"return top.js.OpenExtLink(window,event,this)">ht=
tp://localhost/cgi-bin/perlcal/cal_make.pl</a><br>
?p0=3D%3Cscript%3Ewindow.open('<a href=3D"http://www.google.com%27%29;%3Csc=
ript%3E" target=3D"_blank" onclick=3D"return top.js.OpenExtLink(window,even=
t,this)">http://www.google.com');%3Cscript%3E</a><br>
<br>Other attacks:-<br>
<a href=3D"http://localhost/cgi-bin/perlcal/cal_make.pl" target=3D"_blank" =
onclick=3D"return top.js.OpenExtLink(window,event,this)">http://localhost/c=
gi-bin/perlcal/cal_make.pl</a><br>

?p0=3D%3Cscript%3Ealert(document.cookie);&lt;/script&gt;<br>
<br>
Solution:<br>
--------------------<br>
Vendor has released a patch.<br>
<br>
Credits:- $um$id<br>
<br>
Sumit<br>





------=_Part_17141_22617522.1134045408185--

--===============1929596508==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
--===============1929596508==--

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC