CVE-2014-8596
HighSummary
Multiple SQL injection vulnerabilities in PHP-Fusion version 7.02.07 allow remote authenticated users to execute arbitrary SQL commands. These attacks can be conducted via the submit_id parameter in submissions.php and the status parameter in members.php.
Risk Assessment
These vulnerabilities may lead to unauthorized access to the database, potentially resulting in the exposure or modification of sensitive data. Organizations should be aware of the risks associated with these flaws being exploited by malicious users.
Recommendation
It is recommended to update PHP-Fusion to the latest version to eliminate these vulnerabilities. Additionally, implementing further security measures, such as restricting access to critical functions for unauthorized users, is advisable.
Other vulnerabilities in PHP-Fusion 7.02.07
Original NVD description (English source)
Multiple SQL injection vulnerabilities in PHP-Fusion 7.02.07 allow remote authenticated users to execute arbitrary SQL commands via the (1) submit_id parameter in a 2 action to files/administration/submissions.php or (2) status parameter to files/administration/members.php.