CVE-2005-2075 in PHP-Fusion
Summary
by MITRE
PHP-Fusion 5.0 and 6.0 stores the database file with a predictable filename under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to the filename in the administration/db_backups directory in PHP-Fusion 6.0 or the fusion_admin/db_backups directory in 5.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/22/2025
The vulnerability described in CVE-2005-2075 represents a critical security flaw in PHP-Fusion versions 5.0 and 6.0 that stems from improper file access control mechanisms. This issue manifests when the application stores database backup files with predictable filenames directly within the web document root directory structure. The vulnerability specifically affects the administration/db_backups directory in PHP-Fusion 6.0 and the fusion_admin/db_backups directory in version 5.0, creating an attack surface where unauthorized users can directly access sensitive database backup files through simple HTTP requests.
The technical flaw resides in the application's inadequate security configuration where database backup files are stored with predictable naming conventions and accessible paths within the web server's document root. This design flaw allows remote attackers to enumerate and retrieve database backup files without proper authentication or authorization. The predictable filename pattern combined with the public web directory structure creates a straightforward attack vector that bypasses normal access control mechanisms. According to CWE-200, this vulnerability falls under the category of "Information Exposure" where sensitive data is accessible to unauthorized parties due to improper access control implementation.
The operational impact of this vulnerability is severe as it enables attackers to obtain complete database backups containing sensitive user information, including usernames, passwords, personal data, and potentially administrative credentials. The exposure of database backups can lead to full system compromise, data breaches, and unauthorized access to administrative functions. Attackers can leverage this information to perform credential stuffing attacks, conduct further reconnaissance, or escalate privileges within the affected system. This vulnerability aligns with ATT&CK technique T1213.002 which focuses on data from information repositories, specifically targeting database backups as a source of sensitive information.
The risk is compounded by the fact that these backup files typically contain complete database dumps including user accounts, configuration settings, and application data that could be used for various malicious activities. The vulnerability demonstrates poor security practices in file management and access control implementation, where the application fails to properly isolate sensitive backup files from public web access. Organizations running affected PHP-Fusion versions face significant exposure to data theft and system compromise, as the vulnerability can be exploited without requiring any special privileges or complex attack vectors. Mitigation strategies must include immediate configuration changes to relocate backup files outside the web document root, implementation of proper access controls, and regular security audits to prevent similar issues in future deployments.