CVE-2006-4673
Last modified
CVE-2006-4673 is a vulnerability of currently unknown severity. Global variable overwrite vulnerability in maincore.php in PHP-Fusion 6.01.4 and earlier uses the extract function on the superglobals, which allows remote attackers to conduct SQL injection attacks via the _SERVER[REMOTE_ADDR] parameter to news.php.. EPSS estimates a 1.15% chance of exploitation in the next 30 days.
Description
Global variable overwrite vulnerability in maincore.php in PHP-Fusion 6.01.4 and earlier uses the extract function on the superglobals, which allows remote attackers to conduct SQL injection attacks via the _SERVER[REMOTE_ADDR] parameter to news.php.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Php Fusion | Php Fusion | <= 6.01.4 |
| Php Fusion | Php Fusion | 6.0.105 |
| Php Fusion | Php Fusion | 6.0.106 |
| Php Fusion | Php Fusion | 6.0.107 |
| Php Fusion | Php Fusion | 6.0.109 |
| Php Fusion | Php Fusion | 6.0.110 |
| Php Fusion | Php Fusion | 6.0.204 |
| Php Fusion | Php Fusion | 6.0.206 |
| Php Fusion | Php Fusion | 6.0.303 |
| Php Fusion | Php Fusion | 6.0.304 |
| Php Fusion | Php Fusion | 6.0.306 |
| Php Fusion | Php Fusion | 6.0.307 |
References
- http://secunia.com/advisories/21830Patch, Vendor Advisory
- http://secunia.com/advisories/21830Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2006-4673?
How severe is CVE-2006-4673?
How do I fix CVE-2006-4673?
Are you affected by CVE-2006-4673?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST