CVE-2013-1807 in PHP-Fusion
Summary
by MITRE
PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web document root, which might allow remote attackers to obtain sensitive information via a direct request to the backup file in administration/db_backups/.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/12/2026
The vulnerability identified as CVE-2013-1807 affects PHP-Fusion content management systems prior to version 7.02.06, representing a critical information disclosure weakness that stems from improper file management practices within the application's backup functionality. This flaw specifically resides in the database backup module where the system generates backup files with predictable naming conventions and places them in directories accessible through the web root, creating an avenue for unauthorized access to sensitive database information.
The technical implementation of this vulnerability involves the application's failure to properly secure backup files within restricted directories or implement adequate access controls. When PHP-Fusion generates database backups, it creates files with easily guessable names such as database.sql or similar patterns that follow predictable naming conventions, while placing these files in the administration/db_backups/ directory which is directly accessible through the web server. This configuration violates fundamental security principles of least privilege and proper file access control, as the backup files contain sensitive database structures, user credentials, and potentially confidential business data that should remain protected from public access.
The operational impact of this vulnerability extends beyond simple information disclosure, as the exposed backup files could contain complete database schemas, user account information, and other sensitive data that would be invaluable to attackers pursuing more sophisticated attacks. Remote attackers can directly access these files through simple HTTP requests without requiring authentication or additional exploitation techniques, making this vulnerability particularly dangerous as it allows for immediate data harvesting and potential subsequent attacks such as credential reuse, database manipulation, or privilege escalation within the application environment. The predictability of the file names combined with the unrestricted directory access creates a straightforward path for automated scanning tools to identify and download these sensitive files.
Security practitioners should consider this vulnerability in the context of CWE-200, which addresses information exposure, and its relationship to broader attack patterns in the MITRE ATT&CK framework where adversaries may leverage information gathering techniques to discover sensitive data. The vulnerability demonstrates poor secure coding practices and highlights the importance of implementing proper access controls for backup files, including placing them outside the web root, using random or unpredictable filenames, and implementing authentication checks before allowing access to sensitive system components. Organizations should immediately update to PHP-Fusion version 7.02.06 or later, which addresses this issue by implementing proper directory restrictions and access controls for backup files, while also conducting thorough audits of their web applications to identify similar vulnerabilities in other components that may expose sensitive information through predictable file naming or insecure directory structures.