CVE-2008-1918

EPSS 1.5%

SQL injection vulnerability in submit.php in PHP-Fusion 6.01.14 and 6.00.307, when magic_quotes_gpc is disabled and the database table prefix is known, allows remote authenticated users to execute arbitrary SQL commands via the submit_info[] parameter in a link submission action. NOTE: it was later reported that 7.00.2 is also affected.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/5470unverified cve_referencewww.exploit-db.com/exploits/7576unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://osvdb.org/51052 http://secunia.com/advisories/29930 http://secunia.com/advisories/33295 https://exchange.xforce.ibmcloud.com/vulnerabilities/41914 https://exchange.xforce.ibmcloud.com/vulnerabilities/47610 https://www.exploit-db.com/exploits/5470 https://www.exploit-db.com/exploits/7576 http://www.php-fusion.co.uk/news.php http://www.securityfocus.com/bid/28855 http://www.vupen.com/english/advisories/2008/1318/references