CVE-2020-12461: SQL Injection
PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. An attacker can develop a crafted payload that can be inserted into the sortorder GET parameter on the members.php members search page. This parameter allows for control over anything after the ORDER BY clause in the SQL query.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-12461?
CVE-2020-12461 is a vulnerability in PHP-Fusion 9.03.50 that allows SQL Injection because maincore.php has an insufficient protection mechanism.
How does CVE-2020-12461 work?
An attacker can develop a crafted payload that can be inserted into the sort_order GET parameter on the members.php members search page, allowing for control over anything after the OR operator.
What is the severity of CVE-2020-12461?
CVE-2020-12461 has a high severity rating with a CVSS score of 8.8.
How can I fix CVE-2020-12461?
To fix CVE-2020-12461, update PHP-Fusion to version 9.03.51 or later, which contains the necessary security patches.
Are there any references for CVE-2020-12461?
Yes, you can find more information about CVE-2020-12461 and the security patches in the following references: - [Reference 1](https://github.com/php-fusion/PHP-Fusion/commit/79fe5ec1d5c75e017a6f42127741b9543658f822) - [Reference 2](https://github.com/php-fusion/PHP-Fusion/commit/858e43d7b0ea1897f76d5bcb3a1aed438132c0e2) - [Reference 3](https://github.com/php-fusion/PHP-Fusion/commit/d95cd4a2d22487723266c898b98e6be10754e03d)