Document Title:
===============
Tiva Events Calender v1.4 - Cross Site Scripting Vulnerability
Date:
=====
2023-07-04
References:
===========
https://www.vulnerability-lab.com/get_content.php?id=2276
VL-ID:
=====
2276
Common Vulnerability Scoring System:
====================================
5
Vulnerability Class:
====================
Cross Site Scripting - Persistent
Introduction:
=============
Events Calendar For PHP is a powerful PHP calendar script that can be easily integrated and used with various PHP projects,
such as scheduler, event handler, etc. The calendar is simple to install, deploy, and use. It is suitable for all types of
service businesses to get online reservations without any hassles.
(Copy of the Homepage: https://codecanyon.net/item/tiva-events-calendar-for-php/19199337 )
Abstract:
=========
The vulnerability laboratory core research team discovered a persistent script code inject vulnerability in the Tiva Events Calender v1.4 web-application.
Affected Product(s):
====================
tiva_theme
Product: Tiva Events Calender - Calender PHP (Web-Application)
Report-Timeline:
================
2021-04-03: Researcher Notification & Coordination (Security Researcher)
2021-04-04: Vendor Notification 1 (Security Department)
2021-06-24: Vendor Notification 2 (Security Department)
2021-07-13: Vendor Notification 3 (Security Department)
****-**-**: Vendor Response/Feedback (Security Department)
****-**-**: Vendor Fix/Patch (Service Developer Team)
****-**-**: Security Acknowledgements (Security Department)
2023-07-05: Public Disclosure (Vulnerability Laboratory)
Status:
========
Published
Exploitation-Technique:
=======================
Remote
Severity:
=========
Medium
Details:
========
A persistent input validation web vulnerability has been discovered in the official Tiva Events Calender v1.4 web-application.
The vulnerability allows remote attackers to inject own malicious script codes with persistent attack vector to compromise browser
to web-application requests from the application-side.
The vulnerability is located in the name input field and name parameter. Remote attackers privileged user accounts are able to inject
own malicious script codes as name. Thus results in a persistent execute of the script code in the backend on edit but as well in the
frontend (index) were the event is being displayed after the submit (save) via post method request. In the same direction it is possible
to inject malformed client-side executable script code in get request to trigger a non-persistent execution.
Successful exploitation of the vulnerability results in session hijacking, persistent phishing attacks, persistent external redirects
to malicious source and persistent manipulation of affected frontend / backend application modules.
Request Method(s):
[+] POST / GET
Vulnerable Input(s):
[+] Name
Vulnerable Parameter(s):
[+] name
Affected Module(s):
[+] index.php (Frontend on Event Preview)
[+] edit.php (Backend on Edit ID)
Proof of Concept:
=================
The persistent input validation web vulnerability can be exploited by remote attackers with low privileged user account and with low user interaction.
For security demonstration or to reproduce the persistent cross site web vulnerability follow the provided information and steps below to continue.
Exploitation: Payload
%20"
Vulnerable Source: Frontend (Index)
