Calendarix (cal_cat.php) SQL Injection Vulnerability

                                                ===============================================================================
Calendarix (cal_cat.php) SQL Injection Vulnerability
===============================================================================

Author          : SixP4ck3r
Email & msn     : [email protected]
Date            : 17 July 2010
Critical Lvl    : High
Impact          : Exposure of sensitive information
Where           : From Remote
web		: http://foro.nbsecurity.net/
Credits		: Diablada and Caporal is Bolivian
Dork		: inurl:cal_cat.php?op=
---------------------------------------------------------------------------
[Sofware afected info]
Calendarix it's a events manager based in web write in php, requiere
mysql for database.
[Download]
http://www.calendarix.com/
[Afected versions]
All + 0 day
---------------------------------------------------------------------------
[Bug]

if ($limit>$totalrows) $limit = 0 ;
$query .= " LIMIT ".$limit.",".$limitrow ;

$query = "select ".$qstr.$query ;
// echo "<h4>".$query."</h4>";
$result = mysql_query($query);
$rowname = mysql_fetch_object($result);
$rows = mysql_num_rows($result);
---------------------------------------------------------------------------
[Exploting..demo]

http://example/[path]/calendar/cal_cat.php?op=cat&id=1&year=2010&sort=&catmonth=6&catview=0&limit=[SQL]
---------------------------------------------------------------------------
With R3gards,
SixP4ck3r from Bolivia
___eof____