Title : PHP-Fusion "srch_text" Parameter Remote SQL Injection Vulnerability VUPEN ID : VUPEN/ADV-2005-2730 CVE ID : CVE-2005-4005
Rated as : Moderate Risk
Remotely Exploitable : Yes Locally Exploitable : Yes Release Date : 2005-12-05
Technical Description
A vulnerability has been identified in PHP-Fusion, which may be exploited by remote attackers to execute arbitrary SQL commands. This flaw is due to an input validation error in the "messages.php" script when processing a specially crafted "srch_text" parameter, which may be exploited by malicious users to conduct SQL injection attacks.
