Exploitation Summary
EIP tracks 1 public exploit for CVE-2021-27330. PoCs published by Akash Chathoth. A Nuclei detection template is also available.
AI-analyzed exploit summary This is a functional proof-of-concept for a reflected XSS vulnerability in Triconsole 3.75. The exploit demonstrates how an attacker can inject arbitrary JavaScript code via the URL path, which is then reflected in the response.
Description
Triconsole Datepicker Calendar <3.77 is affected by cross-site scripting (XSS) in calendar_form.php. Attackers can read authentication cookies that are still active, which can be used to perform further attacks such as reading browser history, directory listings, and file contents.
Exploits (1)
This is a functional proof-of-concept for a reflected XSS vulnerability in Triconsole 3.75. The exploit demonstrates how an attacker can inject arbitrary JavaScript code via the URL path, which is then reflected in the response.
Nuclei Templates (1)
http.title:triconsole.com - php calendar date picker
title=triconsole.com - php calendar date picker
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N