""ET WEB_SPECIFIC_APPS PHP Booking Calendar page_info_message parameter Cross-Site Scripting Vulnerability""

SID: 2014067

Revision: 2

Class Type: web-application-attack

Metadata: created_at 2012_01_02, updated_at 2012_01_02

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: $HTTP_SERVERS

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "/details_view.php?"

  • Value: "event_id="

  • Value: "date="

  • Value: "view="

  • Value: "loc="

  • Value: "page_info_message="

Within:

PCRE: "/page_info_message\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)/Ui"

Special Options:

  • nocase

  • http_uri

  • nocase

  • http_uri

  • nocase

  • http_uri

  • nocase

  • http_uri

  • nocase

  • http_uri

  • nocase

  • http_uri

source