CVE-2006-4673

PHP-Fusion 6.0.x - 'news.php' SQL Injection

Severity Score

2.6

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Global variable overwrite vulnerability in maincore.php in PHP-Fusion 6.01.4 and earlier uses the extract function on the superglobals, which allows remote attackers to conduct SQL injection attacks via the _SERVER[REMOTE_ADDR] parameter to news.php.

Vulnerabilidad de sobre escritura de variable global en maincore.php en PHP-Fusion 6.01.4 y anteriores utiliza la función extract sobre super globales, lo que permite a un atacante remoto conducir a ataques de inyección SQL a través del parámetro _SERVER[REMOTE_ADDR] a news.php.

*Credits: N/A

CVSS Scores

NISTv2 2.6

Attack Vector

Network

Attack Complexity

High

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2006-09-07 First Exploit
2006-09-11 CVE Reserved
2006-09-11 CVE Published
2023-07-16 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CAPEC

References (8)

URL	Tag	Source
http://marc.info/?l=bugtraq&m=115765187519458&w=2	Mailing List
http://www.php-fusion.co.uk/news.php?readmore=353	X_refsource_confirm
http://www.vupen.com/english/advisories/2006/3523	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/28818	Vdb Entry

URL	Date	SRC
https://www.exploit-db.com/exploits/28496	2006-09-07
http://retrogod.altervista.org/phpfusion_6-01-4_xpl.html	2024-08-07
http://www.securityfocus.com/bid/19908	2024-08-07

URL	Date	SRC
http://secunia.com/advisories/21830	2017-07-20

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Php Fusion Search vendor "Php Fusion"		Php Fusion Search vendor "Php Fusion" for product "Php Fusion"				<= 6.01.4 Search vendor "Php Fusion" for product "Php Fusion" and version " <= 6.01.4"		-		Affected
Php Fusion Search vendor "Php Fusion"		Php Fusion Search vendor "Php Fusion" for product "Php Fusion"				6.0.105 Search vendor "Php Fusion" for product "Php Fusion" and version "6.0.105"		-		Affected
Php Fusion Search vendor "Php Fusion"		Php Fusion Search vendor "Php Fusion" for product "Php Fusion"				6.0.106 Search vendor "Php Fusion" for product "Php Fusion" and version "6.0.106"		-		Affected
Php Fusion Search vendor "Php Fusion"		Php Fusion Search vendor "Php Fusion" for product "Php Fusion"				6.0.107 Search vendor "Php Fusion" for product "Php Fusion" and version "6.0.107"		-		Affected
Php Fusion Search vendor "Php Fusion"		Php Fusion Search vendor "Php Fusion" for product "Php Fusion"				6.0.109 Search vendor "Php Fusion" for product "Php Fusion" and version "6.0.109"		-		Affected
Php Fusion Search vendor "Php Fusion"		Php Fusion Search vendor "Php Fusion" for product "Php Fusion"				6.0.110 Search vendor "Php Fusion" for product "Php Fusion" and version "6.0.110"		-		Affected
Php Fusion Search vendor "Php Fusion"		Php Fusion Search vendor "Php Fusion" for product "Php Fusion"				6.0.204 Search vendor "Php Fusion" for product "Php Fusion" and version "6.0.204"		-		Affected
Php Fusion Search vendor "Php Fusion"		Php Fusion Search vendor "Php Fusion" for product "Php Fusion"				6.0.206 Search vendor "Php Fusion" for product "Php Fusion" and version "6.0.206"		-		Affected
Php Fusion Search vendor "Php Fusion"		Php Fusion Search vendor "Php Fusion" for product "Php Fusion"				6.0.303 Search vendor "Php Fusion" for product "Php Fusion" and version "6.0.303"		-		Affected
Php Fusion Search vendor "Php Fusion"		Php Fusion Search vendor "Php Fusion" for product "Php Fusion"				6.0.304 Search vendor "Php Fusion" for product "Php Fusion" and version "6.0.304"		-		Affected
Php Fusion Search vendor "Php Fusion"		Php Fusion Search vendor "Php Fusion" for product "Php Fusion"				6.0.306 Search vendor "Php Fusion" for product "Php Fusion" and version "6.0.306"		-		Affected
Php Fusion Search vendor "Php Fusion"		Php Fusion Search vendor "Php Fusion" for product "Php Fusion"				6.0.307 Search vendor "Php Fusion" for product "Php Fusion" and version "6.0.307"		-		Affected