phpFox CVE-2013-5121 SQL Injection Vulnerability

Bugtraq ID:	61868
Class:	Input Validation Error
CVE:	CVE-2013-5121
Remote:	Yes
Local:	No
Published:	Aug 07 2013 12:00AM
Updated:	Aug 07 2013 12:00AM
Credit:	Matias Fontanini
Vulnerable:	phpFox phpFox 3.6.0 build3
Not Vulnerable:	phpFox phpFox 3.6.0 build6

phpFox CVE-2013-5121 SQL Injection Vulnerability

phpFox is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

phpFox 3.6.0 (build3) is vulnerable; other versions may also be affected.

Note: This issue was previously discussed in BID 61660 (phpFox Multiple SQL Injection Vulnerabilities), but has been moved to its own record for better documentation.

phpFox CVE-2013-5121 SQL Injection Vulnerability

An attacker can exploit this issue using a web browser.

phpFox CVE-2013-5121 SQL Injection Vulnerability

Solution:
Reportedly this issue is fixed, however Symantec has not confirmed this. Please contact the vendor for more information.

phpFox CVE-2013-5121 SQL Injection Vulnerability

References:

• PHPFox v3.6.0 (build3) Multiple SQL Injection vulnerabilities (Matias Fontanini)
  
• phpfox Homepage (phpfox)