Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
6
CVSSv2

CVE-2008-1918

Published: 23/04/2008 Updated: 29/09/2017
CVSS v2 Base Score: 6 | Impact Score: 6.4 | Exploitability Score: 6.8
VMScore: 610
Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P
Subscribe to Php-fusion

Vulnerability Summary

SQL injection vulnerability in submit.php in PHP-Fusion 6.01.14 and 6.00.307, when magic_quotes_gpc is disabled and the database table prefix is known, allows remote authenticated users to execute arbitrary SQL commands via the submit_info[] parameter in a link submission action. NOTE: it was later reported that 7.00.2 is also affected.

Vulnerable Product Search on Vulmon Subscribe to Product

php-fusion php-fusion 6.01.14

php-fusion php-fusion 6.00.307

Exploits

Exploit DB: PHP-Fusion 6.01.14 - Blind SQL Injection
#!/usr/bin/python """ #=================================================================================================# # ____ __________ __ ____ __ # # /_ | ____ |__\_____ \ _____/ |_ /_ |/ |_ # # | |/ ...
Exploit DB: PHP-Fusion 7.0.2 - Blind SQL Injection
#!/usr/bin/perl -w # ------------------------------------------------------- # PHP-Fusion <= 7002 Remote Blind SQL Injection Exploit # by athos - staker[at]hotmail[dot]it # download on php-fusioncouk # ------------------------------------------------------- # Usage: # perl xplpl host/path prefix user_id user_pwd target_id # perl xpl ...

References

CWE-89http://www.php-fusion.co.uk/news.phphttp://www.securityfocus.com/bid/28855http://secunia.com/advisories/29930http://osvdb.org/51052http://secunia.com/advisories/33295http://www.vupen.com/english/advisories/2008/1318/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/47610https://exchange.xforce.ibmcloud.com/vulnerabilities/41914https://www.exploit-db.com/exploits/7576https://www.exploit-db.com/exploits/5470https://nvd.nist.govhttps://www.exploit-db.com/exploits/5470/
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
blind SQL injectionfirmwareCVE-2006-4304CVE-2024-32878CVE-2024-31502XSSCVE-2024-3059CVE-2024-33692CVE-2024-3400
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook