CVE-2007-6696
WebCalendar 1.1.6 - Cross-Site Scripting via Event Description, pref.php Query String, and search.php adv Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2007-6696. PoCs published by Omer Singer.
AI-analyzed exploit summary This exploit demonstrates an XSS vulnerability in WebCalendar 1.1.6 by injecting malicious script code via the 'adv' parameter in search.php. The payload uses HTML-encoded JavaScript to trigger an alert, proving arbitrary script execution in the context of the affected site.
Description
Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar 1.1.6 allow remote attackers to inject arbitrary web script or HTML via (1) an event description, (2) the query string to pref.php, and (3) the adv parameter to search.php. NOTE: vector 1 requires user authentication.
Exploits (2)
This exploit demonstrates an XSS vulnerability in WebCalendar 1.1.6 by injecting malicious script code via the 'adv' parameter in search.php. The payload uses HTML-encoded JavaScript to trigger an alert, proving arbitrary script execution in the context of the affected site.
This exploit demonstrates an XSS vulnerability in WebCalendar 1.1.6 by injecting a script tag into the URL, which executes arbitrary JavaScript in the context of the affected site. The PoC leverages improper input sanitization in the `pref.php` endpoint.