===============================================================================
Calendarix (cal_cat.php) SQL Injection Vulnerability
===============================================================================
Author : SixP4ck3r
Email & msn : SixP4ck3r@Bolivia.com
Date : 17 July 2010
Critical Lvl : High
Impact : Exposure of sensitive information
Where : From Remote
web : http://foro.nbsecurity.net/
Credits : Diablada and Caporal is Bolivian
Dork : inurl:cal_cat.php?op=
---------------------------------------------------------------------------
[Sofware afected info]
Calendarix it's a events manager based in web write in php, requiere
mysql for database.
[Download]
http://www.calendarix.com/
[Afected versions]
All + 0 day
---------------------------------------------------------------------------
[Bug]
if ($limit>$totalrows) $limit = 0 ;
$query .= " LIMIT ".$limit.",".$limitrow ;
$query = "select ".$qstr.$query ;
// echo "<h4>".$query."</h4>";
$result = mysql_query($query);
$rowname = mysql_fetch_object($result);
$rows = mysql_num_rows($result);
---------------------------------------------------------------------------
[Exploting..demo]
http://example/[path]/calendar/cal_cat.php?op=cat&id=1&year=2010&sort=&catmonth=6&catview=0&limit=[SQL]
---------------------------------------------------------------------------
With R3gards,
SixP4ck3r from Bolivia
___eof____
