CVE-2013-7375

2014-05-0517:06:05

CWE-89

[email protected]

web.nvd.nist.gov

cve-2013-7375

sql injection

php-fusion

authentication

remote attack

8.4 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.005 Low

EPSS

Percentile

76.5%

JSON

SQL injection vulnerability in includes/classes/Authenticate.class.php in PHP-Fusion 7.02.01 through 7.02.05 allows remote attackers to execute arbitrary SQL commands via the user ID in a user cookie, a different vulnerability than CVE-2013-1803.

Affected configurations

NVD

Node

php-fusionphp-fusionMatch7.02.01

php-fusionphp-fusionMatch7.02.02

php-fusionphp-fusionMatch7.02.03

php-fusionphp-fusionMatch7.02.04

php-fusionphp-fusionMatch7.02.05

CPENameOperatorVersion
php-fusion:php-fusionphp-fusioneq7.02.01
php-fusion:php-fusionphp-fusioneq7.02.02
php-fusion:php-fusionphp-fusioneq7.02.03
php-fusion:php-fusionphp-fusioneq7.02.04
php-fusion:php-fusionphp-fusioneq7.02.05

CPE	Name	Operator	Version
php-fusion:php-fusion	php-fusion	eq	7.02.01
php-fusion:php-fusion	php-fusion	eq	7.02.02
php-fusion:php-fusion	php-fusion	eq	7.02.03
php-fusion:php-fusion	php-fusion	eq	7.02.04
php-fusion:php-fusion	php-fusion	eq	7.02.05