CVE-2013-1803 in PHP-Fusion
Summary
by MITRE
Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) orderby parameter to downloads.php; or remote authenticated users with certain permissions to execute arbitrary SQL commands via a (2) parameter name starting with "delete_attach_" in an edit action to forum/postedit.php; the (3) poll_opts[] parameter in a newthread action to forum/postnewthread.php; the (4) pm_email_notify, (5) pm_save_sent, (6) pm_inbox, (7) pm_sentbox, or (8) pm_savebox parameter to administration/settings_messages.php; the (9) thumb_compression, (10) photo_watermark_text_color1, (11) photo_watermark_text_color2, or (12) photo_watermark_text_color3 parameter to administration/settings_photo.php; the (13) enable parameter to administration/bbcodes.php; the (14) news_image, (15) news_image_t1, or (16) news_image_t2 parameter to administration/news.php; the (17) news_id parameter in an edit action to administration/news.php; or the (18) article_id parameter in an edit action to administration/articles.php. NOTE: the user ID cookie issue in Authenticate.class.php is already covered by CVE-2013-7375.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/12/2026
The vulnerability described in CVE-2013-1803 represents a critical collection of multiple sql injection flaws within the PHP-Fusion content management system prior to version 7.02.06. These vulnerabilities stem from inadequate input validation and sanitization mechanisms that permit malicious actors to inject arbitrary sql commands through various parameters across different modules of the application. The affected parameters span multiple administrative and user-facing components including downloads, forum management, messaging system configurations, photo settings, and news/article editing functionalities, creating an extensive attack surface for potential exploitation.
The technical nature of these vulnerabilities aligns with common weakness enumerations such as cwe-89 sql injection, where user-supplied data is directly incorporated into sql queries without proper escaping or parameterization. The first category of vulnerability involves the orderby parameter in downloads.php, which allows remote attackers to manipulate sql queries through sorting parameters. The second set affects forum/postedit.php where parameters beginning with delete_attach_ can be exploited by authenticated users with specific permissions to inject malicious sql commands during edit operations. Additional attack vectors include poll_opts[] in forum/postnewthread.php, various messaging notification parameters in administration/settings_messages.php, photo watermark color parameters in administration/settings_photo.php, and multiple administrative configuration parameters in bbcodes.php, news.php, and articles.php.
The operational impact of these vulnerabilities is severe as they enable both remote unauthenticated attackers and authenticated users with appropriate permissions to execute arbitrary sql commands against the underlying database. This compromise can result in complete database exposure, data theft, data manipulation, privilege escalation, and potentially full system compromise depending on the database access permissions. The attack surface is particularly concerning because it spans multiple administrative modules and user-facing features, allowing attackers to target different system components and potentially escalate privileges through sequential exploitation attempts. The fact that some vulnerabilities require authenticated access while others are exploitable remotely demonstrates the comprehensive nature of the flaw.
Mitigation strategies should focus on implementing proper input validation, parameterized queries, and input sanitization across all affected modules. Organizations should immediately upgrade to PHP-Fusion version 7.02.06 or later, which contains the necessary patches for these vulnerabilities. Additionally, implementing web application firewalls, input filtering mechanisms, and regular security audits can help prevent exploitation attempts. The vulnerabilities align with attack techniques documented in the attack pattern taxonomy under the category of sql injection attacks, and organizations should consider implementing defense-in-depth strategies including database access controls, query monitoring, and regular security assessments to protect against similar vulnerabilities in other applications.