Description
Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary files via a .. (dot dot) in the (1) user_theme parameter to maincore.php; or remote authenticated administrators to delete arbitrary files via the (2) enable parameter to administration/user_fields.php or (3) file parameter to administration/db_backup.php.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- PHP-Fusion 7.02.05 - Multiple Vulnerabilities EDB-24562 · webapps · Mar 1, 2013
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://www.waraxe.us/advisory-97.html
- [oss-security] 20130302 Re: CVE request: PHP-Fusion waraxe-2013-SA#097 mailing-list
- [oss-security] 20130303 CVE request: PHP-Fusion waraxe-2013-SA#097 mailing-list
- 90692 vdb-entry
- 90694 vdb-entry
- http://packetstormsecurity.com/files/120598/PHP-Fusion-7.02.05-XSS-LFI-SQL-Injection.html
- http://www.php-fusion.co.uk/news.php?readmore=569
- 90696 vdb-entry
- 20130228 [waraxe-2013-SA#097] - Multiple Vulnerabilities in PHP-Fusion 7.02.05 mailing-list