OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Calendarix 0.7.20060401, SQL Injection Vulnerabilities

From: Federico Fazzi (federicoautistici.org)
Date: Thu Jun 15 2006 - 16:39:40 CDT

-----------------------------------------------------
Advisory id: FSA:018

Author: Federico Fazzi
Date: 15/06/2006, 23:36
Sinthesis: Calendarix 0.7.20060401, SQL Injection Vulnerabilities
Type: low
Product: http://www.calendarix.com/
Patch: unavailable
-----------------------------------------------------

1) Description:

Error occured in cal_event.php:

$dquery = "delete from ".$EVENTS_TB." where id='$id'";

Error occured in cal_popup.php:

$id = $_GET['id'];

2) Proof of concept:

http://example/[c_path]/cal_event.php?id=[SQL_QUERY]
http://example/[c_path]/cal_popup.php?id=[SQL_QUERY]

3) Solution:

on cal_event.php sanitized $id variable,
on cal_popup.php don't use $_GET['id'] to assign a value.