PHP-Fusion < 6.00.308 SQL Injection
High Nessus Network Monitor Plugin ID 3622
SynopsisThe remote host is vulnerable to a SQL Injection attack.
DescriptionAccording to its version number, the remote host is running a version of PHP-Fusion that suffers from a flaw within the 'messages.php' script. messages.php fails to correctly parse user-supplied data and is vulnerable to a SQL injection attack. An attacker exploiting this flaw would send a specially formed query to the script. Successful exploitation would result in the attacker being able to execute arbitrary SQL commands on the backend database server.
SolutionUpgrade to version 6.00.308 or higher.