PT-2004-3329 · Php Fusion · Php-Fusion

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2437

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: PHP-Fusion version 4.01

Description: A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the rowstart parameter to index.php or members.php, or the comment id parameter to comments.php.

Recommendations: For PHP-Fusion version 4.01, consider restricting access to the vulnerable parameters rowstart and comment id until a patch is available. As a temporary workaround, avoid using the rowstart parameter in index.php and members.php, and the comment id parameter in comments.php to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2004-2437

Affected Products

Php-Fusion

References · 7

• http://secunia.com/advisories/12686 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-2437 · Security Note
• http://osvdb.org/10438 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2437 · Note
• http://securityfocus.com/bid/11296 · Note
• http://osvdb.org/10437 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17546 · Note