Calendarix 0.7.20070307 allows remote attackers to obtain sensitive information via (1) an invalid month parameter to calendar.php (2) an invalid catview parameter to cal_week.php in a week operation (3) an invalid ycyear parameter to yearcal.php or (4) a direct request to cal_functions.inc.php which reveals the installation path in various error messages.