exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

phpFusion600206.txt

phpFusion600206.txt
Posted Nov 20, 2005
Authored by Robin Verton

PHP-Fusion versions 6.00.206 and below suffer from SQL injection attacks.

tags | exploit, php, sql injection
SHA-256 | 5c759a854ef640ac086d20a4e6915f62b1f78fc833f667effd143990303e0ff0

phpFusion600206.txt

Change Mirror Download
PHP-Fusion <= 6.00.206 Multiple Vulnerabilities 
===============================================

Software: PHP-Fusion <= 6.00.206
Severity: SQL Injection(s), Path disclosure
Risk: High
Author: Robin Verton <r.verton@gmail.com>
Date: Nov. 16 2005
Vendor: http://sourceforge.net/projects/php-fusion/


Description:

"...a light-weight open-source content management system (CMS) written in PHP.
It utilises a mySQL database to store your site content and includes a simple,
comprehensive adminstration system. PHP-Fusion includes the most common features
you would expect to see in many other CMS packages...."
[http://php-fusion.co.uk/]


Details:

1) /subheader.php
Although PHP-Fusion has a good protection against path discolure, it looks like they've forgetten to
include this protection here.

2) /forum/options.php

if (iMEMBER) {
$data = dbarray(dbquery("SELECT * FROM ".$db_prefix."forums WHERE forum_id='".$forum_id."'"));


If the Forum is activated and you are logged in you can insert malicious code into the databse
trough the $forum_id variable.


/forum/viewforum.php?forum_id=4&lastvisited='[SQL injection]

3) /forum/viewforum.php

if (empty($lastvisited)) { $lastvisited = time(); }

[...]

$new_posts = dbcount("(post_id)", "posts", "thread_id='".$data['thread_id']."' and post_datestamp>'$lastvisited'");

To exploit this vulnerability you have to be logged out and a minimum of one thread should be
posted in this forum.
Malicious code can be inserted by requesting the following HTTP-request:

http://www.example.com/forum/viewforum.php?forum_id=1&lastvisited='


Patch:
Set magic_quotes_gpc to ON.

Credits:

Credit goes to Robin Verton

References:

[1] http://sourceforge.net/projects/php-fusion/
[2] http://myblog.it-security23.net
Login or Register to add favorites

File Archive:

November 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    16 Files
  • 2
    Nov 2nd
    17 Files
  • 3
    Nov 3rd
    17 Files
  • 4
    Nov 4th
    11 Files
  • 5
    Nov 5th
    0 Files
  • 6
    Nov 6th
    0 Files
  • 7
    Nov 7th
    3 Files
  • 8
    Nov 8th
    59 Files
  • 9
    Nov 9th
    12 Files
  • 10
    Nov 10th
    6 Files
  • 11
    Nov 11th
    11 Files
  • 12
    Nov 12th
    1 Files
  • 13
    Nov 13th
    0 Files
  • 14
    Nov 14th
    9 Files
  • 15
    Nov 15th
    33 Files
  • 16
    Nov 16th
    53 Files
  • 17
    Nov 17th
    11 Files
  • 18
    Nov 18th
    14 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    26 Files
  • 22
    Nov 22nd
    22 Files
  • 23
    Nov 23rd
    10 Files
  • 24
    Nov 24th
    9 Files
  • 25
    Nov 25th
    11 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    20 Files
  • 29
    Nov 29th
    9 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close