Headline
CVE-2022-4455: Attempt to mitigate reflective XSS attack · sproctor/php-calendar@a294110
A vulnerability, which was classified as problematic, was found in sproctor php-calendar. This affects an unknown part of the file index.php. The manipulation of the argument $_SERVER[‘PHP_SELF’] leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is a2941109b42201c19733127ced763e270a357809. It is recommended to apply a patch to fix this issue. The identifier VDB-215445 was assigned to this vulnerability.
@@ -30,13 +30,13 @@
/*
* $phpc_root_path gives the location of the base calendar install.
* if you move this file to a new location, modify $phpc_root_path to point
* to the location where the support files for the callendar are located.
* to the location where the support files for the calendar are located.
*/
$phpc_root_path = dirname(__FILE__);
$phpc_includes_path = "$phpc_root_path/src";
$phpc_config_file = "$phpc_root_path/config.php";
$phpc_locale_path = "$phpc_root_path/locale";
$phpc_script = htmlentities($_SERVER[‘PHP_SELF’]);
$phpc_script = htmlspecialchars($_SERVER[‘PHP_SELF’], ENT_QUOTES, ‘UTF-8’);
$phpc_server = $_SERVER[‘SERVER_NAME’];
if(!empty($_SERVER[“SERVER_PORT”]) && $_SERVER[“SERVER_PORT”] != 80)