DISPUTED Directory traversal vulnerability in maincore.php in PHP-Fusion allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the folderlevel parameter. NOTE: this issue has been disputed by a reliable third party.

Cross Site Scripting (XSS) vulnerability in infusions/memberpollpanel/polladmin.php in PHP-Fusion 9.03.50, allows attackers to execute arbitrary code, via the polls feature.

Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20.

In PHP-Fusion 9.03.00, editprofile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/formfileinput.php and includes/classes/PHPFusion/Installer/Lib/Core.settings.inc mishandle executable files during avatar upload.

Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command execution (RCE).

There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘requireonce’ statement. This allows arbitrary files with the ‘.php’ extension for which the absolute path is known to be included and executed. There are no known means in PHPFusion through which an attacker can upload and target a ‘.php’ file payload.

PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. An attacker can develop a crafted payload that can be inserted into the sortorder GET parameter on the members.php members search page. This parameter allows for control over anything after the ORDER BY clause in the SQL query.

PHP-Fusion 9.03.50 contains a remote code execution vulnerability in the 'addpanelform()' function that allows attackers to execute arbitrary code through an eval() function with unsanitized POST data. Attackers can exploit the vulnerability by sending crafted panelcontent POST parameters to the panels.php administration endpoint to execute malicious code.

An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature.

SQL injection vulnerability in includes/classes/Authenticate.class.php in PHP-Fusion 7.02.01 through 7.02.05 allows remote attackers to execute arbitrary SQL commands via the user ID in a user cookie, a different vulnerability than CVE-2013-1803.

Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) orderby parameter to downloads.php; or remote authenticated users with certain permissions to execute arbitrary SQL commands via a (2) parameter name starting with "deleteattach" in an edit action to forum/postedit.php; the (3) pollopts[] parameter in a newthread action to forum/postnewthread.php; the (4) pmemailnotify, (5) pmsavesent, (6) pminbox, (7) pmsentbox, or (8) pmsavebox parameter to administration/settingsmessages.php; the (9) thumbcompression, (10) photowatermarktextcolor1, (11) photowatermarktextcolor2, or (12) photowatermarktextcolor3 parameter to administration/settingsphoto.php; the (13) enable parameter to administration/bbcodes.php; the (14) newsimage, (15) newsimaget1, or (16) newsimaget2 parameter to administration/news.php; the (17) newsid parameter in an edit action to administration/news.php; or the (18) articleid parameter in an edit action to administration/articles.php. NOTE: the user ID cookie issue in Authenticate.class.php is already covered by CVE-2013-7375.

Multiple SQL injection vulnerabilities in PHP-Fusion 7.02.07 allow remote authenticated users to execute arbitrary SQL commands via the (1) submitid parameter in a 2 action to files/administration/submissions.php or (2) status parameter to files/administration/members.php.

SQL injection vulnerability in items.php in the E-Cart module 1.3 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the CA parameter.

SQL injection vulnerability in infusions/mguserfotoalbumpanel/mguserfotoalbum.php in the MG User-Fotoalbum (mguserfotoalbumpanel) module 1.0.1 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the albumid parameter.

SQL injection vulnerability in screen.php in the Download System mSF (dsmsf) module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the viewid parameter.

SQL injection vulnerability in books.php in the Book Panel (bookpanel) module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the bookid parameter.

SQL injection vulnerability in blog.php in the Team Impact TI Blog System mod for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the id parameter.

SQL injection vulnerability in index.php in the Freshlinks 1.0 RC1 module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the linkid parameter.

SQL injection vulnerability in classifieds.php in PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the lid parameter in a detailadverts action.

SQL injection vulnerability in kroax.php in the Kroax (thekroax) 4.42 and earlier module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the category parameter.

SQL injection vulnerability in thisraidprogress.php in the World of Warcraft tracker infusion (raidtrackerpanel) module 2.0 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the INFORAIDID parameter.

SQL injection vulnerability in recept.php in the Recepies (Recept) module 1.1 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the katid parameter in a kategorier action. NOTE: some of these details are obtained from third party information.

SQL injection vulnerability in infusions/calendareventspanel/showsingle.php in the Expanded Calendar 2.x module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the sel parameter.

SQL injection vulnerability in readmore.php in PHP-Fusion 4.01 allows remote attackers to execute arbitrary SQL commands via the newsid parameter.

A SQL injection vulnerability in PHP-Fusion 9.03.50 affects the endpoint administration/comments.php via the ctype parameter,

PHPFusion 9.03.110 is affected by a remote code execution vulnerability. The theme function will extract a file to "webroot/themes/{Theme Folder], where an attacker can access and execute arbitrary code.

PHPFusion 9.03.110 is affected by an arbitrary file upload vulnerability. The File Manager function in admin panel does not filter all PHP extensions such as ".php, .php7, .phtml, .php5, ...". An attacker can upload a malicious file and execute code on the server.

SQL injection vulnerability in team.php in the Teams Structure module 3.0 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the teamid parameter.

Multiple directory traversal vulnerabilities in PHP-Fusion Forum Rank System 6 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the settings[locale] parameter to (1) forum.php and (2) profile.php in infusions/ranksystem/. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

SQL injection vulnerability in messages.php in PHP-Fusion 6.01.15 and 7.00.1, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the subject and msgsend parameters, a different vector than CVE-2005-3157, CVE-2005-3158, CVE-2005-3159, CVE-2005-4005, and CVE-2006-2459.