----------------------------------------------------- Advisory id: FSA:018 Author: Federico Fazzi Date: 15/06/2006, 23:36 Sinthesis: Calendarix 0.7.20060401, SQL Injection Vulnerabilities Type: low Product: http://www.calendarix.com/ Patch: unavailable -----------------------------------------------------
1) Description: Error occured in cal_event.php: $dquery = "delete from ".$EVENTS_TB." where id='$id'"; Error occured in cal_popup.php: $id = $_GET['id']; 2) Proof of concept: http://example/[c_path]/cal_event.php?id=[SQL_QUERY] http://example/[c_path]/cal_popup.php?id=[SQL_QUERY] 3) Solution: on cal_event.php sanitized $id variable, on cal_popup.php don't use $_GET['id'] to assign a value.
