CVE-2020-12461

PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism

published April 29, 2020

CVSS
—
EPSS
2%
Percentile
77.0
In the wild
Unconfirmed
What it is

PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. An attacker can develop a crafted payload that can be inserted into the sort_order GET parameter on the members.php members search page. This parameter allows for control over anything after the ORDER BY clause in the SQL query.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01699 · 77.0th percentile
Published
2020-04-29T16:14Z
EPSS history
Timeline
  • 29 APR 16:14Z
    PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism
    cvelistv5