PHP-Fusion Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulnerability - CVE-2013-1803 - Vulnerability Database

PHP-Fusion

PHP-Fusion Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulnerability - CVE-2013-1803

High

Reference: CVE-2013-1803

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2013-1803

Title: PHP-Fusion Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulnerability

Overview:

Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) orderby parameter to downloads.php or remote authenticated users with certain permissions to execute arbitrary SQL commands via a (2) parameter name starting with quotdelete_attach_quot in an edit action to forum/postedit.php the (3) poll_opts parameter in a newthread action to forum/postnewthread.php the (4) pm_email_notify (5) pm_save_sent (6) pm_inbox (7) pm_sentbox or (8) pm_savebox parameter to administration/settings_messages.php the (9) thumb_compression (10) photo_watermark_text_color1 (11) photo_watermark_text_color2 or (12) photo_watermark_text_color3 parameter to administration/settings_photo.php the (13) enable parameter to administration/bbcodes.php the (14) news_image (15) news_image_t1 or (16) news_image_t2 parameter to administration/news.php the (17) news_id parameter in an edit action to administration/news.php or the (18) article_id parameter in an edit action to administration/articles.php. NOTE: the user ID cookie issue in Authenticate.class.php is already covered by CVE-2013-7375.