low2.6Public exploit code
CVE-2006-4673
Global variable overwrite vulnerability in maincore.php in PHP-Fusion 6.01.4 and earlier uses the extract function on the superglobals, which allows remote att…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- PHP-Fusion 6.0.x - 'news.php' SQL Injection2006-09-07 · webapps · php · Verified
Impact
Global variable overwrite vulnerability in maincore.php in PHP-Fusion 6.01.4 and earlier uses the extract function on the superglobals, which allows remote attackers to conduct SQL injection attacks via the _SERVER[REMOTE_ADDR] parameter to news.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Php Fusion | Php Fusion | through 6.01.4 Versions 6.0.105, 6.0.106, 6.0.107, 6.0.109, 6.0.110 |
References
- NVD record
- CVE.org record
- http://marc.info/?l=bugtraq&m=115765187519458&w=2
- http://retrogod.altervista.org/phpfusion_6-01-4_xpl.html
- http://secunia.com/advisories/21830
- http://www.php-fusion.co.uk/news.php?readmore=353
- http://www.securityfocus.com/bid/19908
- http://www.vupen.com/english/advisories/2006/3523
- https://exchange.xforce.ibmcloud.com/vulnerabilities/28818
- http://marc.info/?l=bugtraq&m=115765187519458&w=2
- http://retrogod.altervista.org/phpfusion_6-01-4_xpl.html
- http://secunia.com/advisories/21830
- http://www.php-fusion.co.uk/news.php?readmore=353
- http://www.securityfocus.com/bid/19908
- http://www.vupen.com/english/advisories/2006/3523
- https://exchange.xforce.ibmcloud.com/vulnerabilities/28818