CVE-2013-1803
HighSummary
Multiple SQL injection vulnerabilities in PHP-Fusion before version 7.02.06 allow remote attackers to execute arbitrary SQL commands. Attackers can exploit various parameters in files such as downloads.php, forum/postedit.php, forum/postnewthread.php, and administration/settings_messages.php.
Risk Assessment
These vulnerabilities could lead to unauthorized access to the database, potentially resulting in the exposure of sensitive information or data modification. Organizations should be aware of the risks associated with these flaws being exploited by malicious users.
Recommendation
It is recommended to upgrade PHP-Fusion to version 7.02.06 or later to mitigate these vulnerabilities. Additionally, conducting a security audit of the application and implementing appropriate protections against SQL injection is advisable.
Other vulnerabilities in PHP-Fusion
Original NVD description (English source)
Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) orderby parameter to downloads.php; or remote authenticated users with certain permissions to execute arbitrary SQL commands via a (2) parameter name starting with "delete_attach_" in an edit action to forum/postedit.php; the (3) poll_opts[] parameter in a newthread action to forum/postnewthread.php; the (4) pm_email_notify, (5) pm_save_sent, (6) pm_inbox, (7) pm_sentbox, or (8) pm_savebox parameter to administration/settings_messages.php; the (9) thumb_compression, (10) photo_watermark_text_color1, (11) photo_watermark_text_color2, or (12) photo_watermark_text_color3 parameter to administration/settings_photo.php; the (13) enable parameter to administration/bbcodes.php; the (14) news_image, (15) news_image_t1, or (16) news_image_t2 parameter to administration/news.php; the (17) news_id parameter in an edit action to administration/news.php; or the (1