CVE-2009-0831: SQL Injection
SQL injection vulnerability in members.php in the Members CV (job) module 1.0 for PHP-Fusion, when magicquotesgpc is disabled, allows remote authenticated users to execute arbitrary SQL commands via the sortby parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enable magic_quotes_gpc in the PHP configuration (php.ini / runtime) so that the Members CV (job) module 1.0 does not run with magic_quotes_gpc disabled, which is the condition that allows SQL injection via the sortby parameter.
PHP (affecting Members CV (job) module 1.0 for PHP-Fusion) magic_quotes_gpc = on
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0831?
CVE-2009-0831 is classified as a medium severity vulnerability that allows SQL injection attacks.
How do I fix CVE-2009-0831?
To fix CVE-2009-0831, enable magic_quotes_gpc or apply an update that addresses the SQL injection in the Members CV module.
Who is impacted by CVE-2009-0831?
Remote authenticated users of PHP-Fusion Members CV module version 1.0 are impacted by CVE-2009-0831.
What is the exploitation method for CVE-2009-0831?
CVE-2009-0831 can be exploited by sending specially crafted SQL commands through the sortby parameter in members.php.
Is CVE-2009-0831 specific to certain PHP-Fusion installations?
Yes, CVE-2009-0831 specifically affects installations of the Members CV module version 1.0 when magic_quotes_gpc is disabled.