Calendarix SQL Injection

`===============================================================================  
Calendarix (cal_cat.php) SQL Injection Vulnerability  
===============================================================================  
  
Author : SixP4ck3r  
Email & msn : [email protected]  
Date : 17 July 2010  
Critical Lvl : High  
Impact : Exposure of sensitive information  
Where : From Remote  
web : http://foro.nbsecurity.net/  
Credits : Diablada and Caporal is Bolivian  
Dork : inurl:cal_cat.php?op=  
---------------------------------------------------------------------------  
[Sofware afected info]  
Calendarix it's a events manager based in web write in php, requiere  
mysql for database.  
[Download]  
http://www.calendarix.com/  
[Afected versions]  
All + 0 day  
---------------------------------------------------------------------------  
[Bug]  
  
if ($limit>$totalrows) $limit = 0 ;  
$query .= " LIMIT ".$limit.",".$limitrow ;  
  
$query = "select ".$qstr.$query ;  
// echo "<h4>".$query."</h4>";  
$result = mysql_query($query);  
$rowname = mysql_fetch_object($result);  
$rows = mysql_num_rows($result);  
---------------------------------------------------------------------------  
[Exploting..demo]  
  
http://example/[path]/calendar/cal_cat.php?op=cat&id=1&year=2010&sort=&catmonth=6&catview=0&limit=[SQL]  
---------------------------------------------------------------------------  
With R3gards,  
SixP4ck3r from Bolivia  
___eof____  
  
`