Calendarix Input Validation Flaws in 'cal_event.php' and 'cal_popup.php' Let Remote Users Inject SQL Commands
|
|
SecurityTracker Alert ID: 1016324 |
|
SecurityTracker URL: http://securitytracker.com/id/1016324
|
|
CVE Reference:
CVE-2006-3094
(Links to External Site)
|
Updated: Oct 13 2008
|
Original Entry Date: Jun 19 2006
|
Impact:
Disclosure of system information, Disclosure of user information, User access via network
|
Exploit Included: Yes
|
Version(s): 0.7.20060401
|
Description:
A vulnerability was reported in Calendarix. A remote user can inject SQL commands.
The 'cal_event.php' and 'cal_popup.php' scripts do not properly validate user-supplied input in the 'id' parameter. A remote user can supply a specially crafted parameter value to execute SQL commands on the underlying database.
Some demonstration exploit URLs are provided:
http://[target]/[c_path]/cal_event.php?id=[SQL_QUERY]
http://[target]/[c_path]/cal_popup.php?id=[SQL_QUERY]
Federico Fazzi reported this vulnerability.
|
Impact:
A remote user can execute SQL commands on the underlying database.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.calendarix.com/ (Links to External Site)
|
Cause:
Input validation error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Thu, 15 Jun 2006 23:39:40 +0200
Subject: Calendarix 0.7.20060401, SQL Injection Vulnerabilities
|
-----------------------------------------------------
Advisory id: FSA:018
Author: Federico Fazzi
Date: 15/06/2006, 23:36
Sinthesis: Calendarix 0.7.20060401, SQL Injection Vulnerabilities
Type: low
Product: http://www.calendarix.com/
Patch: unavailable
-----------------------------------------------------
1) Description:
Error occured in cal_event.php:
$dquery = "delete from ".$EVENTS_TB." where id='$id'";
Error occured in cal_popup.php:
$id = $_GET['id'];
2) Proof of concept:
http://example/[c_path]/cal_event.php?id=[SQL_QUERY]
http://example/[c_path]/cal_popup.php?id=[SQL_QUERY]
3) Solution:
on cal_event.php sanitized $id variable,
on cal_popup.php don't use $_GET['id'] to assign a value.
|
|
