CVE-2021-27330

MEDIUMNuclei

Triconsole 3.75 - Reflected XSS

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-27330 has a selected CVSS score of 6.1 (medium); EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

Triconsole Datepicker Calendar <3.77 is affected by cross-site scripting (XSS) in calendar_form.php. Attackers can read authentication cookies that are still active, which can be used to perform further attacks such as reading browser history, directory listings, and file contents.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Nuclei templates
1

Proofs of concept

1

Catalogued exploits

ExploitDBTriconsole 3.75 - Reflected XSSExploitDB exploitby Akash ChathothNot analyzed1 file
ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMTriconsole Datepicker Calendar <3.77 - Cross-Site ScriptingCVSS 6.1

Triconsole Datepicker Calendar before 3.77 contains a cross-site scripting vulnerability in calendar_form.php. Attackers can read authentication cookies that are still active, which can be used to perform further attacks such as reading browser history, directory listings, and file contents.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Upgrade to a patched version of Triconsole Datepicker Calendar that properly validates user input to prevent XSS attacks.

WeaknessesCWE-79
Authorspikpikcu, daffainfo
Template tagscve2021cvexssedbtriconsolevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:triconsole:datepicker_calendar:*:*:*:*:*:*:*:*
Shodan: http.title:triconsole.com - php calendar date picker
FOFA: title=triconsole.com - php calendar date picker
Google: intitle:TriConsole.com - PHP Calendar Date Picker
Google: intitle:triconsole.com - php calendar date picker
https://www.exploit-db.com/exploits/49597 http://www.triconsole.com/ http://www.triconsole.com/php/calendar_datepicker.php https://nvd.nist.gov/vuln/detail/CVE-2021-27330 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

5