CVE-2023-0289 – Webcalendar

Stored XSS

Webcalendar has a feature to add event and display the location of it. This feature lead to stored xss everytime a user open the calendar or the event detail page.

POC – Proof of concept

• 1- login as user
• 2- create an event
• 3- insert the payload on “location” field
• 4- Save
• 5- Go back to the calendar
• 6- XSS

PAYLOAD: "><svg><animatetransform onbegin=alert(document.cookie)>

Impact

If an attacker can control a script that is executed in the victim’s browser, then they can typically fully compromise that user. The attacker can carry out any of the actions that are applicable to the impact of reflected XSS vulnerabilities.

Severity

https://cvss.js.org/#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Reference

https://huntr.dev/bounties/b9584c87-60e8-4a03-9e79-5f1e2d595361/

https://nvd.nist.gov/vuln/detail/CVE-2023-0289

https://github.com/craigk5n/webcalendar