what you don't know can hurt you

WordPress Scoutnet Kalender 1.1.0 Cross Site Scripting

WordPress Scoutnet Kalender 1.1.0 Cross Site Scripting
Posted Dec 10, 2019
Authored by Simon Moser

WordPress Scoutnet Kalender plugin version 1.1.0 suffers from a cross site scripting vulnerability.

tags | exploit, xss
advisories | CVE-2019-19198
MD5 | e04e112fcfa436f18ef05c4933998c2c

WordPress Scoutnet Kalender 1.1.0 Cross Site Scripting

Change Mirror Download
Hash: SHA512

Advisory ID: SYSS-2019-045
Product: "Scoutnet Kalender" for WordPress
Manufacturer: Scoutnet and Björn Stromberg
Affected Version(s): 1.1.0
Tested Version(s): 1.1.0
Vulnerability Type: Cross-Site Scripting (CWE-79)
Risk Level: Medium
Solution Status: Open
Manufacturer Notification: 2019-10-23
Solution Date: -
Public Disclosure: 2019-12-09
CVE Reference: CVE-2019-19198
Author of Advisory: Simon Moser, SySS GmbH



"Scoutnet Kalender" is a plug-in for WordPress to display one oder many
Scoutnet calendars as a widget, on a page or an article.

Due to a missing input sanitation, it is vulnerable to cross-site scripting.


Vulnerability Details:

The plug-in allows to include calendars from Scoutnet into WordPress websites.
Calendars are not only included by websites administrated by the same person
as the calendar but also by other sites. When events from a calendar are
included, the data is not being sanitized. This allows an attacker with control
over an embedded calendar to inject scripts into the attacked site.


Proof of Concept (PoC):

1. Create an event with the following value of the "Info" field:
<script>alert("Cross-Site Scripting");</script>

2. Save the event

3. Visit the page where the calendar is embedded



As long as the default template is not changed by the manufacturer, SySS GmbH
recommends to change the provided template to sanitize fields controlled by
other users. If this is not possible because interactive content needs to be
included, the set of users with permissions to create and change events should
be as small as possible.


Disclosure Timeline:

2019-10-20: Vulnerability discovered
2019-10-23: Vulnerability reported to manufacturer
2019-11-12: Discussion with the manufacturer about security by design
2019-12-09: Public disclosure of vulnerability



[1] Product website for "Scoutnet Kalender"
[2] SySS Security Advisory SYSS-2019-045
[3] SySS Responsible Disclosure Policy



This security vulnerability was found by Simon Moser of SySS

E-Mail: simon.moser@syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Simon_Moser.asc
Key ID: 0x5FF2CFC6
Key Fingerprint: E3C2 A86E 530D 8BD3 C40B 6542 8376 5B89 5FF2 CFC6



The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS Web



Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en




RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

February 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    1 Files
  • 2
    Feb 2nd
    2 Files
  • 3
    Feb 3rd
    17 Files
  • 4
    Feb 4th
    15 Files
  • 5
    Feb 5th
    24 Files
  • 6
    Feb 6th
    16 Files
  • 7
    Feb 7th
    19 Files
  • 8
    Feb 8th
    1 Files
  • 9
    Feb 9th
    2 Files
  • 10
    Feb 10th
    15 Files
  • 11
    Feb 11th
    20 Files
  • 12
    Feb 12th
    12 Files
  • 13
    Feb 13th
    18 Files
  • 14
    Feb 14th
    17 Files
  • 15
    Feb 15th
    4 Files
  • 16
    Feb 16th
    4 Files
  • 17
    Feb 17th
    34 Files
  • 18
    Feb 18th
    15 Files
  • 19
    Feb 19th
    19 Files
  • 20
    Feb 20th
    20 Files
  • 21
    Feb 21st
    11 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files
  • 29
    Feb 29th
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2016 Packet Storm. All rights reserved.

Security Services
Hosting By