PHP-Fusion v6.00.109 SQL Injection and Info. Disclosure

In the latest version of PHP-Fusion, the content management system by Digitanium php-fusion.co.uk, there is an SQL Error in messages.php that reveals path names and a table name, and someone could possibly manipulate the SQL database. The error is as follows, it is with the Search and Sort option...

CVE-2005-3877

Multiple SQL injection vulnerabilities in Simple Document Management System SDMS 2.0-CVS and earlier allow remote attackers to execute arbitrary SQL commands via the 1 folderid parameter in list.php and 2 mid parameter in a view action to messages.php...

CVE-2005-3877: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Simple Document Management System SDMS 2.0-CVS and earlier allow remote attackers to execute arbitrary SQL commands via the 1 folderid parameter in list.php and 2 mid parameter in a view action to messages.php...

CVE-2005-3875: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Enterprise Connector 1.0.2 and earlier allow remote attackers to execute arbitrary SQL commands via the messageid parameter in 1 send.php or 2 a delete action in messages.php...

CVE-2005-3159

CVE-2005-3159 is a SQL injection vulnerability in PHP-Fusion, specifically in messages.php where the msg_view parameter can be exploited to execute arbitrary SQL. It is described as a different vulnerability from CVE-2005-3157 and CVE-2005-3158, and is rated HIGH (CVSS v2 base score 7.5) with net...

CVE-2005-3157: Undefined Security Weakness

SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to execute arbitrary SQL commands via the msgsend parameter, a different vulnerability than CVE-2005-3158 and CVE-2005-3159...

CVE-2005-3159: Undefined Security Weakness

SQL injection vulnerability in messages.php in PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the msgview parameter, a different vulnerability than CVE-2005-3157 and CVE-2005-3158...

CVE-2005-3158: Undefined Security Weakness

SQL injection vulnerability in messages.php in PHP-Fusion 6.00.106 and 6.00.107 allows remote attackers to execute arbitrary SQL commands via the 1 pmemailnotify and 2 pmsavesent parameters, a different vulnerability than CVE-2005-3157 and CVE-2005-3159...

PT-2005-3982 · Php Fusion · Php-Fusion

SQL injection vulnerability in messages.php in PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the msg view parameter, a different vulnerability than CVE-2005-3157 and CVE-2005-3158...

PHP-Fusion 4.0/5.0/6.0 - 'messages.php' SQL Injection

source: https://www.securityfocus.com/bid/14489/info PHP-Fusion is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'messages.php' script before using it in an SQL query. Successful exploitation could result...

PHP-Fusion 4.05.06.0 - messages.php SQL Injection

PHP-Fusion 4.05.06.0 - messages.php SQL Injection source: https://www.securityfocus.com/bid/14489/info PHP-Fusion is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'messages.php' script before using it in ...