Calendarix Multiple SQL Injection Vulnerabilities
BID:16456
Info
Calendarix Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 16456 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 01 2006 12:00AM |
| Updated: | Feb 07 2006 08:53PM |
| Credit: | Aliaksandr Hartsuyeu is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
Calendarix Calendarix 0.7.20060401 |
| Not Vulnerable: | |
Discussion
Calendarix Multiple SQL Injection Vulnerabilities
Calendarix is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. If the PHP global variable 'gpc_magic_quotes' is set to 'off', the attacker may be able to bypass authentication to the application.
Version 0.6.20050830 is vulnerable; other versions may also be affected.
Calendarix is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. If the PHP global variable 'gpc_magic_quotes' is set to 'off', the attacker may be able to bypass authentication to the application.
Version 0.6.20050830 is vulnerable; other versions may also be affected.
Exploit / POC
Calendarix Multiple SQL Injection Vulnerabilities
An exploit is not required.
Example URI are available:
http://www.example.com/calendarix/admin/cal_login.php
username: ' or 1/*
password: any
http://www.example.com/calendarix/cal_day.php?op=day&date=2006-01-10&catview=99% 20union%20select%2012345
An exploit is not required.
Example URI are available:
http://www.example.com/calendarix/admin/cal_login.php
username: ' or 1/*
password: any
http://www.example.com/calendarix/cal_day.php?op=day&date=2006-01-10&catview=99% 20union%20select%2012345
Solution / Fix
Calendarix Multiple SQL Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Calendarix Multiple SQL Injection Vulnerabilities
References:
References: