Calendarix (cal_cat.php) SQL Injection Vulnerability

vendor:

Calendarix

by:

SixP4ck3r

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: Calendarix

Affected Version From: All

Affected Version To: 0 day

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

Calendarix (cal_cat.php) SQL Injection Vulnerability

Calendarix is a web-based events manager written in PHP and requires MySQL for the database. The vulnerability exists in the cal_cat.php file, where the 'limit' parameter is not properly sanitized before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. An attacker can exploit this vulnerability to gain access to sensitive information.

Mitigation:

Input validation should be used to ensure that untrusted data is not used to generate SQL queries. Additionally, parameterized queries should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

===============================================================================
Calendarix (cal_cat.php) SQL Injection Vulnerability
===============================================================================

Author          : SixP4ck3r
Email & msn     : SixP4ck3r@Bolivia.com
Date            : 17 July 2010
Critical Lvl    : High
Impact          : Exposure of sensitive information
Where           : From Remote
web		: http://foro.nbsecurity.net/
Credits		: Diablada and Caporal is Bolivian
Dork		: inurl:cal_cat.php?op=
---------------------------------------------------------------------------
[Sofware afected info]
Calendarix it's a events manager based in web write in php, requiere
mysql for database.
[Download]
http://www.calendarix.com/
[Afected versions]
All + 0 day
---------------------------------------------------------------------------
[Bug]

if ($limit>$totalrows) $limit = 0 ;
$query .= " LIMIT ".$limit.",".$limitrow ;

$query = "select ".$qstr.$query ;
// echo "<h4>".$query."</h4>";
$result = mysql_query($query);
$rowname = mysql_fetch_object($result);
$rows = mysql_num_rows($result);
---------------------------------------------------------------------------
[Exploting..demo]

http://example/[path]/calendar/cal_cat.php?op=cat&id=1&year=2010&sort=&catmonth=6&catview=0&limit=[SQL]
---------------------------------------------------------------------------
With R3gards,
SixP4ck3r from Bolivia
___eof____