bugtraq - Calendarix 0.7.20060401, SQL Injection Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <4491D39C.3050107@autistici.org>
Date: Thu, 15 Jun 2006 23:39:40 +0200
From: Federico Fazzi <federico@...istici.org>
To: bugtraq@...urityfocus.com
Subject: Calendarix 0.7.20060401, SQL Injection Vulnerabilities


-----------------------------------------------------
Advisory id: FSA:018

Author:    Federico Fazzi
Date:	   15/06/2006, 23:36
Sinthesis: Calendarix 0.7.20060401, SQL Injection Vulnerabilities
Type:	   low
Product:   http://www.calendarix.com/
Patch:	   unavailable
-----------------------------------------------------


1) Description:


Error occured in cal_event.php:

$dquery = "delete from ".$EVENTS_TB." where id='$id'";

Error occured in cal_popup.php:

$id = $_GET['id'];

2) Proof of concept:

http://example/[c_path]/cal_event.php?id=[SQL_QUERY]
http://example/[c_path]/cal_popup.php?id=[SQL_QUERY]

3) Solution:

on cal_event.php sanitized $id variable,
on cal_popup.php don't use $_GET['id'] to assign a value.