Description

SQL injection vulnerability in submit.php in PHP-Fusion 6.01.14 and 6.00.307, when magic_quotes_gpc is disabled and the database table prefix is known, allows remote authenticated users to execute arbitrary SQL commands via the submit_info[] parameter in a link submission action. NOTE: it was later reported that 7.00.2 is also affected.

Remediation

References

CVE-2008-1918

Related Vulnerabilities

Apache HTTP Server Resource Management Errors Vulnerability (CVE-2005-3357)

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2015-3273)

PHP Other Vulnerability (CVE-2007-0909)

ownCloud Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-2149)

WordPress Plugin WooCommerce Open Redirect (3.7.0)

Severity

Medium

Classification

CVE-2008-1918 CWE-138

Tags

Missing Update Known Vulnerabilities