[CVE-2014-1607.] Cross Site Scripting(XSS) in Drupal Event calendar module

[ali.hussein@xxxxxxxxxx]

Advisory ID: hag2014101
Product: EventCalendar 
Vendor: Drupal
Vulnerable Version(s): Drupal 7.14 and probably newer version
Tested Version: Drupal 7.14
Advisory Publication: January 23, 2014 
Vendor Notification: November 20, 2013 
Public Disclosure: January 23, 2014 
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2014-1607
Risk Level: Medium 
CVSSv2 Base Score: 6.4 (AV:N/AC:H/Au:N/C:N/I:P/A:N)
Solution Status: Solution not yet released
Discovered and Provided: help AG Middle East

------------------------------------------------------------------------

-----------------------

about the vendor:
Drupal is an open source content management platform powering millions of 
websites and applications. It?s built, used, and supported by an active and 
diverse community of people around the world.
Advisory Details:

During a Pentest Help AG auditors(Ali & Khalilov) discovered the following:
Reflected cross-site scripting (XSS) vulnerability in Drupal 7.14 EventCalendar 
Module, found in eventcalendar/year  allows remote attackers to inject 
arbitrary web scripts or HTML after the inproperly sanitizited Year Parameter
an adversary might use this vulnerability, an onmouseover payload was injected 
after the year which gets executed succssfully. 
1) Cross-Site Scripting (XSS) in Mediatrix Web Management Interface: 
CVE-2014-1612

As proof of concept, one needs to access the following URL on a 
eventcalander/2013%22%20onmouseover%3dalert%28%27XSSed%27%29%20bad%3d%22 on the 
vulnerable website

Hackers could craft malicious URLs and send them and use them to steal cookies 
properly compromise the application. 
------------------------------------------------------------------------

-----------------------

Solution:

The vendor was notified, contact the vendor for the patch details

------------------------------------------------------------------------

-----------------------

References:

[1] help AG middle East http://www.helpag.com/.
[2] Drupal https://drupal.org/
[3]
[4] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - 
international in scope and free for public use, CVE® is a dictionary of 
publicly known information security vulnerabilities and exposures.
[5] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to 
developers and security practitioners, CWE is a formal list of software 
weakness types.

------------------------------------------------------------------------

-----------------------

Disclaimer: The information provided in this Advisory is provided "as is" and 
without any warranty of any kind. Details of this Advisory may be updated in 
order to provide as accurate information as possible.