946 matches found
CVE-2004-1724
The ReadMe First.txt file in PHP-Fusion 4.0 instructs users to set the permissions on the fusionadmin/dbbackups directory to world read/write/execute 777, which allows remote attackers to download or view database backups, which have easily guessable filenames and contain the administrator userna...
CVE-2004-1723: Undefined Security Weakness
The 1 updateuser.php and 2 forumsprune.php scripts in PHP-Fusion 4.00 allow remote attackers to obtain sensitive information via a direct HTTP request, which reveals the installation path in an error message...
CVE-2004-1724: Undefined Security Weakness
The ReadMe First.txt file in PHP-Fusion 4.0 instructs users to set the permissions on the fusionadmin/dbbackups directory to world read/write/execute 777, which allows remote attackers to download or view database backups, which have easily guessable filenames and contain the administrator userna...
php-fusion.txt
TheGreatOne2176, Reapercore I have a found an error in php-fusion 4.x where you can view any thread on the forum. In fusionforum/viewthread.php the $GET variables arent properly checked or queried making it possible to view all threads. The example I tested was...
CVE-2005-0345
CVE-2005-0345 affects php-fusion 4.x where viewthread.php does not validate (1) forum_id or (2) forum_cat parameters, enabling remote attackers to view protected forums by supplying a thread_id. Reported impact is partial confidentiality loss; exploitation appears through crafted thread access ra...
CVE-2005-0345
viewthread.php in php-fusion 4.x does not check the 1 forumid or 2 forumcat parameters, which allows remote attackers to view protected forums via the threadid parameter...
CVE-2005-0345: Undefined Security Weakness
viewthread.php in php-fusion 4.x does not check the 1 forumid or 2 forumcat parameters, which allows remote attackers to view protected forums via the threadid parameter...
PHP-Fusion < 5.00 viewthread.php Arbitrary Message Thread / Forum Access
A vulnerability exists in the version of PHP-Fusion installed on the remote host that may allow an attacker to read the contents of arbitrary forums and threads, regardless of the attacker's privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...
PHP-Fusion Detection
The remote host is running PHP-Fusion, a light-weight, open source content management system written in PHP. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid16335; scriptversion"1.18"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/06/01";...
PHP-Fusion 4.0 - 'Viewthread.php' Information Disclosure
source: https://www.securityfocus.com/bid/12482/info PHP-Fusion is reportedly affected by an information disclosure vulnerability. This issue is due to the application failing to properly sanitize user-supplied input. It is reported that an attacker could leverage this vulnerability to view any...
PHP-Fusion viewthread.php Arbitrary Thread Access
Binary data 2598.prm...
PHP-Fusion 4.0 - Viewthread.php Information Disclosure
PHP-Fusion 4.0 - Viewthread.php Information Disclosure source: https://www.securityfocus.com/bid/12482/info PHP-Fusion is reportedly affected by an information disclosure vulnerability. This issue is due to the application failing to properly sanitize user-supplied input. It is reported that an...
php-fusion 4.x vuln
TheGreatOne2176, Reapercore I have a found an error in php-fusion 4.x where you can view any thread on the forum. In fusionforum/viewthread.php the $GET variables arent properly checked or queried making it possible to view all threads. The example I tested was...
[SA14090] PHP-Fusion "forum_search.php" Information Disclosure
TITLE: PHP-Fusion "forumsearch.php" Information Disclosure SECUNIA ADVISORY ID: SA14090 VERIFY ADVISORY: http://secunia.com/advisories/14090/ CRITICAL: Less critical IMPACT: Exposure of sensitive information WHERE: From remote SOFTWARE: PHP-Fusion 4.x http://secunia.com/product/3803/ DESCRIPTION:...
CVE-2004-2437
SQL injection vulnerability in PHP-Fusion 4.01 allows remote attackers to execute arbitrary SQL commands via the rowstart parameter to 1 index.php or 2 members.php, or 3 the commentid parameter to comments.php...
CVE-2004-2438
Cross-site scripting XSS vulnerability in PHP-Fusion 4.01 allows remote attackers to inject arbitrary web script or HTML via the 1 Submit News, 2 Submit Link or 3 Submit Article field...
CVE-2004-1723
The 1 updateuser.php and 2 forumsprune.php scripts in PHP-Fusion 4.00 allow remote attackers to obtain sensitive information via a direct HTTP request, which reveals the installation path in an error message...
PHP-Fusion 4.01 Multiple Vulnerabilities
A vulnerability exists in the version of PHP-Fusion installed on the remote host that may allow an authenticated attacker to inject arbitrary SQL code due to improper validation of user-supplied input to the 'rowstart' parameter of script 'members.php' and the 'commentid' parameter of the...
PHP-Fusion Database Multiple Vulnerabilities
Binary data 2352.prm...
PHP-Fusion homepage address Parameter XSS
A vulnerability exists in the version of PHP-Fusion installed on the remote host that could allow an attacker to perform a cross-site scripting attack and execute arbitrary HTML and script code in the context of the user's browser. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...