40 lines
No EOL
1.4 KiB
Text
40 lines
No EOL
1.4 KiB
Text
===============================================================================
|
|
Calendarix (cal_cat.php) SQL Injection Vulnerability
|
|
===============================================================================
|
|
|
|
Author : SixP4ck3r
|
|
Email & msn : SixP4ck3r@Bolivia.com
|
|
Date : 17 July 2010
|
|
Critical Lvl : High
|
|
Impact : Exposure of sensitive information
|
|
Where : From Remote
|
|
web : http://foro.nbsecurity.net/
|
|
Credits : Diablada and Caporal is Bolivian
|
|
Dork : inurl:cal_cat.php?op=
|
|
---------------------------------------------------------------------------
|
|
[Sofware afected info]
|
|
Calendarix it's a events manager based in web write in php, requiere
|
|
mysql for database.
|
|
[Download]
|
|
http://www.calendarix.com/
|
|
[Afected versions]
|
|
All + 0 day
|
|
---------------------------------------------------------------------------
|
|
[Bug]
|
|
|
|
if ($limit>$totalrows) $limit = 0 ;
|
|
$query .= " LIMIT ".$limit.",".$limitrow ;
|
|
|
|
$query = "select ".$qstr.$query ;
|
|
// echo "<h4>".$query."</h4>";
|
|
$result = mysql_query($query);
|
|
$rowname = mysql_fetch_object($result);
|
|
$rows = mysql_num_rows($result);
|
|
---------------------------------------------------------------------------
|
|
[Exploting..demo]
|
|
|
|
http://example/[path]/calendar/cal_cat.php?op=cat&id=1&year=2010&sort=&catmonth=6&catview=0&limit=[SQL]
|
|
---------------------------------------------------------------------------
|
|
With R3gards,
|
|
SixP4ck3r from Bolivia
|
|
___eof____ |