SQL injection vulnerability in includes/classes/Authenticate.class.php in PHP-Fusion 7.02.01 through 7.02.05 allows remote attackers to execute arbitrary SQL commands via the user ID in a user cookie, a different vulnerability than CVE-2013-1803.

Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) orderby parameter to downloads.php; or remote authenticated users with certain permissions to execute arbitrary SQL commands via a (2) parameter name starting with "deleteattach" in an edit action to forum/postedit.php; the (3) pollopts[] parameter in a newthread action to forum/postnewthread.php; the (4) pmemailnotify, (5) pmsavesent, (6) pminbox, (7) pmsentbox, or (8) pmsavebox parameter to administration/settingsmessages.php; the (9) thumbcompression, (10) photowatermarktextcolor1, (11) photowatermarktextcolor2, or (12) photowatermarktextcolor3 parameter to administration/settingsphoto.php; the (13) enable parameter to administration/bbcodes.php; the (14) newsimage, (15) newsimaget1, or (16) newsimaget2 parameter to administration/news.php; the (17) newsid parameter in an edit action to administration/news.php; or the (18) articleid parameter in an edit action to administration/articles.php. NOTE: the user ID cookie issue in Authenticate.class.php is already covered by CVE-2013-7375.

Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary files via a .. (dot dot) in the (1) usertheme parameter to maincore.php; or remote authenticated administrators to delete arbitrary files via the (2) enable parameter to administration/userfields.php or (3) file parameter to administration/dbbackup.php.

PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web document root, which might allow remote attackers to obtain sensitive information via a direct request to the backup file in administration/dbbackups/.

Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbitrary web script or HTML via the (1) highlight parameter to forum/viewthread.php; or remote authenticated users with certain permissions to inject arbitrary web script or HTML via the (2) userlist or (3) usertypes parameter to messages.php; (4) message parameter to infusions/shoutboxpanel/shoutboxadmin.php; (5) message parameter to administration/news.php; (6) panellist parameter to administration/paneleditor.php; (7) HTTP User Agent string to administration/phpinfo.php; (8) "BBCODE" parameter to administration/bbcodes.php; errorMessage parameter to (9) articlecats.php, (10) downloadcats.php, (11) newscats.php, or (12) weblinkcats.php in administration/, when error is 3; or (13) body or (14) body2 parameter to administration/articles.php.