Detections
Analytics
PHP-Fusion < 6.00.308 SQL Injection
high Nessus Network Monitor Plugin ID 3622
Synopsis
The remote host is vulnerable to a SQL Injection attack.Description
According to its version number, the remote host is running a version of PHP-Fusion that suffers from a flaw within the 'messages.php' script. messages.php fails to correctly parse user-supplied data and is vulnerable to a SQL injection attack. An attacker exploiting this flaw would send a specially formed query to the script. Successful exploitation would result in the attacker being able to execute arbitrary SQL commands on the backend database server.Solution
Upgrade to version 6.00.308 or higher.See Also
Plugin Details
Severity: High
ID: 3622
Family: CGI
Published: 5/17/2006
Updated: 3/6/2019
Risk Information
VPR
Risk Factor: Medium
Score: 6.6
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.2
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: High
Base Score: 7.3
Temporal Score: 6.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:php_fusion:php_fusion