Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
An authenticated malicious user can take advantage of a Stored XSS vulnerability in the "Calendar" feature.
<details/open/ontoggle=alert(document.cookie)>
If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user.
The text was updated successfully, but these errors were encountered:
You have Instagram I'd
Sorry, something went wrong.
CVE-2022-44962
@yeshojha2
i only have twitter: anhdq201
No branches or pull requests
Version: 2.4p5
Description
An authenticated malicious user can take advantage of a Stored XSS vulnerability in the "Calendar" feature.
Proof of Concept
Step 1: Go to "/calendar/viewcalendar.php?", click "Add" and insert payload "
<details/open/ontoggle=alert(document.cookie)>" in "Subject" field.Step 2: Alert XSS Message
Impact
If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user.
The text was updated successfully, but these errors were encountered: