CVE-2020-12461

PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. An attacker can develop a crafted payload that can be inserted into the sortorder GET parameter on the members.php members search page. This parameter allows for control over anything after the...

EUVD-2020-4770

Malware in sbrugna...

CVE-2020-12461

PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. An attacker can develop a crafted payload that can be inserted into the sortorder GET parameter on the members.php members search page. This parameter allows for control over anything after the...

Sql injection

PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. An attacker can develop a crafted payload that can be inserted into the sortorder GET parameter on the members.php members search page. This parameter allows for control over anything after the...

CVE-2020-12461

PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. An attacker can develop a crafted payload that can be inserted into the sortorder GET parameter on the members.php members search page. This parameter allows for control over anything after the...

CVE-2020-12461

PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. An attacker can develop a crafted payload that can be inserted into the sortorder GET parameter on the members.php members search page. This parameter allows for control over anything after the...

CVE-2020-12461

Summary: CVE-2020-12461 affects PHP-Fusion 9.03.50 and allows SQL Injection via the sort_order GET parameter on members.php, due to insufficient protection in maincore.php. Multiple connected sources corroborate the vulnerability and its impact on SQL semantics after ORDER BY, with references ind...

CVE-2020-12461: Improper Neutralization of Special Elements used in an SQL Command

PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. An attacker can develop a crafted payload that can be inserted into the sortorder GET parameter on the members.php members search page. This parameter allows for control over anything after the...

PT-2020-5578

Name of the Vulnerable Software and Affected Versions PHP-Fusion version 9.03.50 Description The issue is related to insufficient protection mechanisms in the maincore.php file, allowing for SQL injection attacks. An attacker can craft a payload to insert into the sort order GET parameter on the...

Directory traversal

Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary files via a .. dot dot in the 1 usertheme parameter to maincore.php; or remote authenticated administrators to delete arbitrary files via the 2 enable...

CVE-2013-1806

Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary files via a .. dot dot in the 1 usertheme parameter to maincore.php; or remote authenticated administrators to delete arbitrary files via the 2 enable...

PT-2014-2498

Name of the Vulnerable Software and Affected Versions PHP-Fusion versions prior to 7.02.06 Description The issue allows remote authenticated users to include and execute arbitrary files via a .. dot dot in the user theme parameter to "maincore.php". Additionally, remote authenticated administrato...

CVE-2013-1806: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary files via a .. dot dot in the 1 usertheme parameter to maincore.php; or remote authenticated administrators to delete arbitrary files via the 2 enable...

[waraxe-2013-SA#097] - Multiple Vulnerabilities in PHP-Fusion 7.02.05

waraxe-2013-SA097 - Multiple Vulnerabilities in PHP-Fusion 7.02.05 =============================================================================== Author: Janek Vind "waraxe" Date: 27. February 2013 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-97.html Description of vulnerable...

CVE-2010-4931

Directory traversal vulnerability in maincore.php in PHP-Fusion allows remote attackers to include and execute arbitrary local files via a .. dot dot in the folderlevel parameter. NOTE: this issue has been disputed by a reliable third party...

Directory traversal

Directory traversal vulnerability in maincore.php in PHP-Fusion allows remote attackers to include and execute arbitrary local files via a .. dot dot in the folderlevel parameter. NOTE: this issue has been disputed by a reliable third party...

CVE-2010-4931

Directory traversal vulnerability in maincore.php in PHP-Fusion allows remote attackers to include and execute arbitrary local files via a .. dot dot in the folderlevel parameter. NOTE: this issue has been disputed by a reliable third party...

CVE-2010-4931

PHP-Fusion exposes a directory traversal flaw in maincore.php, allowing local file inclusion via a ../ detour in the folder_level parameter. Impact stated as remote code execution on affected environments through arbitrary local files. Affected product: PHP-Fusion (maincore.php). Root cause: dire...

CVE-2010-4931: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in maincore.php in PHP-Fusion allows remote attackers to include and execute arbitrary local files via a .. dot dot in the folderlevel parameter. NOTE: this issue has been disputed by a reliable third party...

PHP-Fusion Local File Inclusion Vulnerability

Exploit for php platform in category web applications ============================================= PHP-Fusion Local File Inclusion Vulnerability ============================================= Author: MoDaMeR Email: email protected My Sites : www.v4-team.com & www.hackteach.org Script home:...