Description
SQL injection vulnerability in submit.php in PHP-Fusion 6.01.14 and 6.00.307, when magic_quotes_gpc is disabled and the database table prefix is known, allows remote authenticated users to execute arbitrary SQL commands via the submit_info[] parameter in a link submission action. NOTE: it was later reported that 7.00.2 is also affected.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 2
- PHP-Fusion 7.0.2 - Blind SQL Injection EDB-7576 · webapps · Dec 24, 2008 · verified
- PHP-Fusion 6.01.14 - Blind SQL Injection EDB-5470 · webapps · Apr 19, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 33295 third-party-advisory
- http://www.php-fusion.co.uk/news.php
- phpfusion-submit-sql-injection(41914) vdb-entry
- 5470 exploit
- ADV-2008-1318 vdb-entry
- 7576 exploit
- 29930 third-party-advisory
- 28855 vdb-entry
- 51052 vdb-entry
- phpfusion-submitinfo-sql-injection(47610) vdb-entry