PHP-Fusion 9.03.50 panels.php is vulnerable to cross-site scripting (XSS) via the 'panelcontent' POST parameter. The application fails to properly sanitize user input before rendering it in the browser, allowing attackers to inject arbitrary JavaScript. This can be exploited by submitting crafted input to the 'panelcontent' field in panels.php, resulting in execution of malicious scripts in the context of the affected site.
PHP-Fusion 9.03.50 contains a remote code execution vulnerability in the 'addpanelform()' function that allows attackers to execute arbitrary code through an eval() function with unsanitized POST data. Attackers can exploit the vulnerability by sending crafted panelcontent POST parameters to the panels.php administration endpoint to execute malicious code.
Cross Site Scripting (XSS) vulnerability in PHP-Fusion 9.03.60 via 'New Shout' in /infusions/shoutboxpanel/shoutboxadmin.php.
SQL injection vulnerability in includes/classes/Authenticate.class.php in PHP-Fusion 7.02.01 through 7.02.05 allows remote attackers to execute arbitrary SQL commands via the user ID in a user cookie, a different vulnerability than CVE-2013-1803.
Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) orderby parameter to downloads.php; or remote authenticated users with certain permissions to execute arbitrary SQL commands via a (2) parameter name starting with "deleteattach" in an edit action to forum/postedit.php; the (3) pollopts[] parameter in a newthread action to forum/postnewthread.php; the (4) pmemailnotify, (5) pmsavesent, (6) pminbox, (7) pmsentbox, or (8) pmsavebox parameter to administration/settingsmessages.php; the (9) thumbcompression, (10) photowatermarktextcolor1, (11) photowatermarktextcolor2, or (12) photowatermarktextcolor3 parameter to administration/settingsphoto.php; the (13) enable parameter to administration/bbcodes.php; the (14) newsimage, (15) newsimaget1, or (16) newsimaget2 parameter to administration/news.php; the (17) newsid parameter in an edit action to administration/news.php; or the (18) articleid parameter in an edit action to administration/articles.php. NOTE: the user ID cookie issue in Authenticate.class.php is already covered by CVE-2013-7375.
PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web document root, which might allow remote attackers to obtain sensitive information via a direct request to the backup file in administration/dbbackups/.
Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary files via a .. (dot dot) in the (1) usertheme parameter to maincore.php; or remote authenticated administrators to delete arbitrary files via the (2) enable parameter to administration/userfields.php or (3) file parameter to administration/dbbackup.php.
Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbitrary web script or HTML via the (1) highlight parameter to forum/viewthread.php; or remote authenticated users with certain permissions to inject arbitrary web script or HTML via the (2) userlist or (3) usertypes parameter to messages.php; (4) message parameter to infusions/shoutboxpanel/shoutboxadmin.php; (5) message parameter to administration/news.php; (6) panellist parameter to administration/paneleditor.php; (7) HTTP User Agent string to administration/phpinfo.php; (8) "BBCODE" parameter to administration/bbcodes.php; errorMessage parameter to (9) articlecats.php, (10) downloadcats.php, (11) newscats.php, or (12) weblinkcats.php in administration/, when error is 3; or (13) body or (14) body2 parameter to administration/articles.php.
DISPUTED Directory traversal vulnerability in maincore.php in PHP-Fusion allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the folderlevel parameter. NOTE: this issue has been disputed by a reliable third party.
SQL injection vulnerability in books.php in the Book Panel (bookpanel) module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the bookid parameter.
SQL injection vulnerability in items.php in the E-Cart module 1.3 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the CA parameter.
SQL injection vulnerability in members.php in the Members CV (job) module 1.0 for PHP-Fusion, when magicquotesgpc is disabled, allows remote authenticated users to execute arbitrary SQL commands via the sortby parameter.
SQL injection vulnerability in readmore.php in PHP-Fusion 4.01 allows remote attackers to execute arbitrary SQL commands via the newsid parameter.
SQL injection vulnerability in blog.php in the Team Impact TI Blog System mod for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the id parameter.
Cross-site scripting (XSS) vulnerability in infusions/shoutboxpanel/shoutboxpanel.php in PHP-Fusion 6.01.10 and 6.01.9, when guest posts are enabled, allows remote authenticated users to inject arbitrary web script or HTML via the URI, related to the FUSIONQUERY constant.