This host is running PHP-Fusion Teams Structure Module and is prone to SQL injection vulnerability.

Successful exploitation will allow remote attackers to to view, add, modify or delete information in the back-end database. Impact Level: Application.

No solution or patch was made available for at least one year since disclosure of this vulnerability. Likely none will be provided anymore. General solution options are to upgrade to a newer release, disable respective features, remove the product or replace the product by another one.

The flaw is due to input passed via the 'team_id' parameter to 'infusions/teams_structure/team.php' is not properly sanitised before being used in SQL queries.

PHP-Fusion Teams Structure 3.0

• http://secunia.com/advisories/42943
• http://www.exploit-db.com/exploits/16004/
• http://xforce.iss.net/xforce/xfdb/64727

---

Updated on 2015-03-25