Calendarix – ‘cal_cat.php’ SQL Injection
=============================================================================== Calendarix (cal_cat.php) SQL Injection Vulnerability =============================================================================== Author : SixP4ck3r Email & msn : SixP4ck3r@Bolivia.com Date : 17 July 2010 Critical Lvl : High Impact : Exposure of sensitive information Where : From Remote web : http://foro.nbsecurity.net/ Credits : Diablada and Caporal is Bolivian Dork : inurl:cal_cat.php?op= --------------------------------------------------------------------------- [Sofware afected info] Calendarix it's a events manager based in web write in php, requiere mysql for database. [Download] http://www.calendarix.com/ [Afected versions] All + 0 day --------------------------------------------------------------------------- [Bug] if ($limit>$totalrows) $limit = 0 ; $query .= " LIMIT ".$limit.",".$limitrow ; $query = "select ".$qstr.$query ; // echo "<h4>".$query."</h4>"; $result = mysql_query($query); $rowname = mysql_fetch_object($result); $rows = mysql_num_rows($result); --------------------------------------------------------------------------- [Exploting..demo] http://example/[path]/calendar/cal_cat.php?op=cat&id=1&year=2010&sort=&catmonth=6&catview=0&limit=[SQL] --------------------------------------------------------------------------- With R3gards, SixP4ck3r from Bolivia ___eof____ |