Description

PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web document root, which might allow remote attackers to obtain sensitive information via a direct request to the backup file in administration/db_backups/.

Remediation

References

CVE-2013-1807

Related Vulnerabilities

Rukovoditel Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2022-43288)

WordPress Plugin Livemesh Addons for Elementor Security Bypass (2.5.2)

Rukovoditel Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-44948)

WebLogic Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2019-2725)

WordPress Plugin DukaPress SQL Injection (2.5.9)

Severity

Medium

Classification

CVE-2013-1807 CWE-264

Tags

Missing Update Known Vulnerabilities