Description : A vulnerability is reported in the forum module of PHP-Fusion 6.00.206 and some early released versions. When the forum module is activated, a registered user can execute arbitrary SQL injection commands. The failure exists because the application does not properly sanitize user-supplied input in 'options.php' and 'viewforum.php' before using it in the SQL query, and magic_quotes_gpc is set to off.

Apply the patch from the php-fusion main site: http://www.php-fusion.co.uk/downloads.php?cat_id=3

• http://secunia.com/advisories/17664/
• http://www.securityfocus.com/bid/15502

---

Updated on 2015-03-25