what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

WordPress Event Easy Calendar 1.0.0 XSS / CSRF / Input Validation

WordPress Event Easy Calendar 1.0.0 XSS / CSRF / Input Validation
Posted Sep 7, 2013
Authored by RogueCoder

WordPress Event Easy Calendar plugin version 1.0.0 suffers from cross site request forgery, improper input validation, and cross site scripting vulnerabilities.

tags | advisory, vulnerability, xss, csrf
SHA-256 | 99d655a0c9c8a25a0b7eaf9c6ce3daeb52c19a8c54fd9affaa61e8f6f78ddd8b

WordPress Event Easy Calendar 1.0.0 XSS / CSRF / Input Validation

Change Mirror Download
Details
========================
Application: Event Easy Calendar
Version: 1.0.0
Type: WordPress Plugin
Vendor: Adamson ( http://profiles.wordpress.org/adamson/ )
Url: http://wordpress.org/plugins/event-easy-calendar/
Vulnerability:
- Improper Input Validation (CWE-20)
- Cross-Site Scripting (CWE-79)
- Cross-Site Request Forgery (CWE-352)

Description
========================
Events Easy Calendar will enable WordPress sites to manage all their bookings and appointments.

Vulnerability
========================
This plugin contains CSRF on all forms and some are also vulnerable to XSS. This entire plugin can be remotely controlled by crafting arbitrary payloads and send a malicious link to a site admin. By doing this you can create and update customers, create new services/cupons, change settings, enable reminders/auto approval, delete all bookings, etc. It's also possible to modify the PayPal recipient email address, so that all payments are sent to the attacker instead of the service provider. The cost of any services are also easily modified.

Solution
========================
No fix by vendor at this point. Remove the plugin from your WordPress installation.

Timeline
========================
2013-08-15 Wrote a comment pointing out to the vendor that there was some vulnerabilities and that a report would be made the same day. Comment was deleted.
2013-08-15 Contacted the vendor through the plugin support section on wordpress.org, where I requested a valid email to send the report to.
2013-08-16 Third and last message sent to vendor in an attempt to get a valid email address to send the report to
2013-08-16 An email address were provided by the plugin developer
2013-08-25 Vulnerability details were sent to the provided email address
2013-09-02 Details were sent to plugins@wordpress.org
2013-09-05 Confirmation email recieved from Wordpress
2013-09-05 Plugin has been removed from the plugin directory
2013-09-07 Publicly disclosed


Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    22 Files
  • 18
    Apr 18th
    0 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close