GSD-2013-1803

Vulnerability from gsd - Updated: 2023-12-13 01:22
Details
Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) orderby parameter to downloads.php; or remote authenticated users with certain permissions to execute arbitrary SQL commands via a (2) parameter name starting with "delete_attach_" in an edit action to forum/postedit.php; the (3) poll_opts[] parameter in a newthread action to forum/postnewthread.php; the (4) pm_email_notify, (5) pm_save_sent, (6) pm_inbox, (7) pm_sentbox, or (8) pm_savebox parameter to administration/settings_messages.php; the (9) thumb_compression, (10) photo_watermark_text_color1, (11) photo_watermark_text_color2, or (12) photo_watermark_text_color3 parameter to administration/settings_photo.php; the (13) enable parameter to administration/bbcodes.php; the (14) news_image, (15) news_image_t1, or (16) news_image_t2 parameter to administration/news.php; the (17) news_id parameter in an edit action to administration/news.php; or the (18) article_id parameter in an edit action to administration/articles.php. NOTE: the user ID cookie issue in Authenticate.class.php is already covered by CVE-2013-7375.
Aliases
Aliases
CVE-2013-1803
To clipboard 

{
  "GSD": {
    "alias": "CVE-2013-1803",
    "description": "Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) orderby parameter to downloads.php; or remote authenticated users with certain permissions to execute arbitrary SQL commands via a (2) parameter name starting with \"delete_attach_\" in an edit action to forum/postedit.php; the (3) poll_opts[] parameter in a newthread action to forum/postnewthread.php; the (4) pm_email_notify, (5) pm_save_sent, (6) pm_inbox, (7) pm_sentbox, or (8) pm_savebox parameter to administration/settings_messages.php; the (9) thumb_compression, (10) photo_watermark_text_color1, (11) photo_watermark_text_color2, or (12) photo_watermark_text_color3 parameter to administration/settings_photo.php; the (13) enable parameter to administration/bbcodes.php; the (14) news_image, (15) news_image_t1, or (16) news_image_t2 parameter to administration/news.php; the (17) news_id parameter in an edit action to administration/news.php; or the (18) article_id parameter in an edit action to administration/articles.php.  NOTE: the user ID cookie issue in Authenticate.class.php is already covered by CVE-2013-7375.",
    "id": "GSD-2013-1803"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2013-1803"
      ],
      "details": "Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) orderby parameter to downloads.php; or remote authenticated users with certain permissions to execute arbitrary SQL commands via a (2) parameter name starting with \"delete_attach_\" in an edit action to forum/postedit.php; the (3) poll_opts[] parameter in a newthread action to forum/postnewthread.php; the (4) pm_email_notify, (5) pm_save_sent, (6) pm_inbox, (7) pm_sentbox, or (8) pm_savebox parameter to administration/settings_messages.php; the (9) thumb_compression, (10) photo_watermark_text_color1, (11) photo_watermark_text_color2, or (12) photo_watermark_text_color3 parameter to administration/settings_photo.php; the (13) enable parameter to administration/bbcodes.php; the (14) news_image, (15) news_image_t1, or (16) news_image_t2 parameter to administration/news.php; the (17) news_id parameter in an edit action to administration/news.php; or the (18) article_id parameter in an edit action to administration/articles.php.  NOTE: the user ID cookie issue in Authenticate.class.php is already covered by CVE-2013-7375.",
      "id": "GSD-2013-1803",
      "modified": "2023-12-13T01:22:19.878060Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secalert@redhat.com",
        "ID": "CVE-2013-1803",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) orderby parameter to downloads.php; or remote authenticated users with certain permissions to execute arbitrary SQL commands via a (2) parameter name starting with \"delete_attach_\" in an edit action to forum/postedit.php; the (3) poll_opts[] parameter in a newthread action to forum/postnewthread.php; the (4) pm_email_notify, (5) pm_save_sent, (6) pm_inbox, (7) pm_sentbox, or (8) pm_savebox parameter to administration/settings_messages.php; the (9) thumb_compression, (10) photo_watermark_text_color1, (11) photo_watermark_text_color2, or (12) photo_watermark_text_color3 parameter to administration/settings_photo.php; the (13) enable parameter to administration/bbcodes.php; the (14) news_image, (15) news_image_t1, or (16) news_image_t2 parameter to administration/news.php; the (17) news_id parameter in an edit action to administration/news.php; or the (18) article_id parameter in an edit action to administration/articles.php.  NOTE: the user ID cookie issue in Authenticate.class.php is already covered by CVE-2013-7375."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "http://www.waraxe.us/advisory-97.html",
            "refsource": "MISC",
            "url": "http://www.waraxe.us/advisory-97.html"
          },
          {
            "name": "90714",
            "refsource": "OSVDB",
            "url": "http://osvdb.org/show/osvdb/90714"
          },
          {
            "name": "[oss-security] 20130302 Re: CVE request: PHP-Fusion waraxe-2013-SA#097",
            "refsource": "MLIST",
            "url": "http://www.openwall.com/lists/oss-security/2013/03/03/2"
          },
          {
            "name": "90710",
            "refsource": "OSVDB",
            "url": "http://osvdb.org/90710"
          },
          {
            "name": "[oss-security] 20130303 CVE request: PHP-Fusion waraxe-2013-SA#097",
            "refsource": "MLIST",
            "url": "http://www.openwall.com/lists/oss-security/2013/03/03/1"
          },
          {
            "name": "90712",
            "refsource": "OSVDB",
            "url": "http://osvdb.org/90712"
          },
          {
            "name": "http://packetstormsecurity.com/files/120598/PHP-Fusion-7.02.05-XSS-LFI-SQL-Injection.html",
            "refsource": "MISC",
            "url": "http://packetstormsecurity.com/files/120598/PHP-Fusion-7.02.05-XSS-LFI-SQL-Injection.html"
          },
          {
            "name": "http://www.php-fusion.co.uk/news.php?readmore=569",
            "refsource": "CONFIRM",
            "url": "http://www.php-fusion.co.uk/news.php?readmore=569"
          },
          {
            "name": "90709",
            "refsource": "OSVDB",
            "url": "http://osvdb.org/90709"
          },
          {
            "name": "90713",
            "refsource": "OSVDB",
            "url": "http://osvdb.org/90713"
          },
          {
            "name": "90711",
            "refsource": "OSVDB",
            "url": "http://osvdb.org/90711"
          },
          {
            "name": "90693",
            "refsource": "OSVDB",
            "url": "http://osvdb.org/90693"
          },
          {
            "name": "90695",
            "refsource": "OSVDB",
            "url": "http://osvdb.org/90695"
          },
          {
            "name": "20130228 [waraxe-2013-SA#097] - Multiple Vulnerabilities in PHP-Fusion 7.02.05",
            "refsource": "FULLDISC",
            "url": "http://seclists.org/fulldisclosure/2013/Feb/154"
          },
          {
            "name": "52403",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/52403"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:php-fusion:php-fusion:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "7.02.05",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:php-fusion:php-fusion:7.02.01:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:php-fusion:php-fusion:7.02.04:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:php-fusion:php-fusion:7.02.03:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:php-fusion:php-fusion:7.02.02:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2013-1803"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) orderby parameter to downloads.php; or remote authenticated users with certain permissions to execute arbitrary SQL commands via a (2) parameter name starting with \"delete_attach_\" in an edit action to forum/postedit.php; the (3) poll_opts[] parameter in a newthread action to forum/postnewthread.php; the (4) pm_email_notify, (5) pm_save_sent, (6) pm_inbox, (7) pm_sentbox, or (8) pm_savebox parameter to administration/settings_messages.php; the (9) thumb_compression, (10) photo_watermark_text_color1, (11) photo_watermark_text_color2, or (12) photo_watermark_text_color3 parameter to administration/settings_photo.php; the (13) enable parameter to administration/bbcodes.php; the (14) news_image, (15) news_image_t1, or (16) news_image_t2 parameter to administration/news.php; the (17) news_id parameter in an edit action to administration/news.php; or the (18) article_id parameter in an edit action to administration/articles.php.  NOTE: the user ID cookie issue in Authenticate.class.php is already covered by CVE-2013-7375."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-89"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.php-fusion.co.uk/news.php?readmore=569",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://www.php-fusion.co.uk/news.php?readmore=569"
            },
            {
              "name": "[oss-security] 20130303 CVE request: PHP-Fusion waraxe-2013-SA#097",
              "refsource": "MLIST",
              "tags": [],
              "url": "http://www.openwall.com/lists/oss-security/2013/03/03/1"
            },
            {
              "name": "52403",
              "refsource": "SECUNIA",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/52403"
            },
            {
              "name": "20130228 [waraxe-2013-SA#097] - Multiple Vulnerabilities in PHP-Fusion 7.02.05",
              "refsource": "FULLDISC",
              "tags": [],
              "url": "http://seclists.org/fulldisclosure/2013/Feb/154"
            },
            {
              "name": "http://www.waraxe.us/advisory-97.html",
              "refsource": "MISC",
              "tags": [],
              "url": "http://www.waraxe.us/advisory-97.html"
            },
            {
              "name": "90714",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://osvdb.org/show/osvdb/90714"
            },
            {
              "name": "90693",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://osvdb.org/90693"
            },
            {
              "name": "90709",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://osvdb.org/90709"
            },
            {
              "name": "90713",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://osvdb.org/90713"
            },
            {
              "name": "90695",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://osvdb.org/90695"
            },
            {
              "name": "90712",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://osvdb.org/90712"
            },
            {
              "name": "[oss-security] 20130302 Re: CVE request: PHP-Fusion waraxe-2013-SA#097",
              "refsource": "MLIST",
              "tags": [],
              "url": "http://www.openwall.com/lists/oss-security/2013/03/03/2"
            },
            {
              "name": "90710",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://osvdb.org/90710"
            },
            {
              "name": "90711",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://osvdb.org/90711"
            },
            {
              "name": "http://packetstormsecurity.com/files/120598/PHP-Fusion-7.02.05-XSS-LFI-SQL-Injection.html",
              "refsource": "MISC",
              "tags": [],
              "url": "http://packetstormsecurity.com/files/120598/PHP-Fusion-7.02.05-XSS-LFI-SQL-Injection.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2014-05-10T03:52Z",
      "publishedDate": "2014-05-05T17:06Z"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.