phpFox CVE-2013-5120 SQL Injection Vulnerability
BID:61660
Info
phpFox CVE-2013-5120 SQL Injection Vulnerability
| Bugtraq ID: | 61660 |
| Class: | Input Validation Error |
| CVE: |
CVE-2013-5120 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 07 2013 12:00AM |
| Updated: | Aug 20 2013 08:57PM |
| Credit: | Matias Fontanini |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
phpFox CVE-2013-5120 SQL Injection Vulnerability
phpFox is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
phpFox 3.6.0 (build3) is vulnerable; other versions may also be affected.
Note: The issue described by CVE-2013-5121 has been moved to BID 61868 (phpFox CVE-2013-5121 SQL Injection Vulnerability) to better document it.
phpFox is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
phpFox 3.6.0 (build3) is vulnerable; other versions may also be affected.
Note: The issue described by CVE-2013-5121 has been moved to BID 61868 (phpFox CVE-2013-5121 SQL Injection Vulnerability) to better document it.
Exploit / POC
phpFox CVE-2013-5120 SQL Injection Vulnerability
An attacker can exploit this issue using a web browser.
An attacker can exploit this issue using a web browser.
Solution / Fix
phpFox CVE-2013-5120 SQL Injection Vulnerability
Solution:
Reportedly this issue is fixed, however Symantec has not confirmed this. Please contact the vendor for more information.
Solution:
Reportedly this issue is fixed, however Symantec has not confirmed this. Please contact the vendor for more information.