Lucene search
HistorySep 11, 2006 - 4:04 p.m.
CVE-2006-4673
cve-2006-4673
php-fusion
maincore.php
extract function
superglobals
sql injection
remote attackers
nvd
7.6 High
AI Score
Confidence
Low
2.6 Low
CVSS2
Access Vector
Access Complexity
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:H/Au:N/C:N/I:P/A:N
0.01 Low
EPSS
Percentile
83.7%
Global variable overwrite vulnerability in maincore.php in PHP-Fusion 6.01.4 and earlier uses the extract function on the superglobals, which allows remote attackers to conduct SQL injection attacks via the _SERVER[REMOTE_ADDR] parameter to news.php.
Affected configurations
Node
php_fusionphp_fusionRange≤6.01.4
ORphp_fusionphp_fusionMatch6.0.105
ORphp_fusionphp_fusionMatch6.0.106
ORphp_fusionphp_fusionMatch6.0.107
ORphp_fusionphp_fusionMatch6.0.109
ORphp_fusionphp_fusionMatch6.0.110
ORphp_fusionphp_fusionMatch6.0.204
ORphp_fusionphp_fusionMatch6.0.206
ORphp_fusionphp_fusionMatch6.0.303
ORphp_fusionphp_fusionMatch6.0.304
ORphp_fusionphp_fusionMatch6.0.306
ORphp_fusionphp_fusionMatch6.0.307
Related
cvelist
cvelist
CVE-2006-4673
2006-09-11 16:00:00
nessus
nessus
PHP-Fusion extract() Global Variable Overwriting
2006-09-08 00:00:00
nvd
nvd
CVE-2006-4673
2006-09-11 16:04:00
7.6 High
AI Score
Confidence
Low
2.6 Low
CVSS2
Access Vector
Access Complexity
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:H/Au:N/C:N/I:P/A:N
0.01 Low
EPSS
Percentile
83.7%
Related for CVE-2006-4673