|
7.02.04 vulnerability
|
| coach4all |
Posted on 22-02-2012 09:45
|
Newbie
Posts: 1
Joined: 14/11/2011
|
Since 2 days, 2 of my sites using php-fusion gets modified php files with redirections to offensive sites.
Google points to sites like packetstormsecurity.org with "PHP-Fusion version 7.02.04 suffers from a remote SQL injection vulnerability".
What is the best way to repair and how to prevent?
(or when to expect a security patch/upgrade?) |
| |
|
|
| Christian |
Posted on 22-02-2012 12:13
|
Admin
Posts: 131
Joined: 19/09/2005
|
I will announce the availability of v7.02.05 in a few days 
Best regards,
Christian Damsgaard Jørgensen,
PHP-Fusion Lead Developer.
|
| |
|
|
| val |
Posted on 26-02-2012 16:51
|
Junior Member
Posts: 41
Joined: 11/01/2006
|
PMM wrote:
I will announce the availability of v7.02.05 in a few days
now we passed the "few" days period   |
| |
|
|
| Pete_Hes |
Posted on 29-02-2012 11:39
|
Newbie
Posts: 8
Joined: 29/01/2010
|
http://packetstor...n7-sql.txt
PHP-Fusion version 7.02.04 suffers from a remote SQL injection vulnerability in weblinks.php. |
| |
|
|
| HaYaLeT |
Posted on 29-02-2012 12:35
|
Senior Member
Posts: 276
Joined: 31/10/2008
|
and downloads.php |
| |
|
|
| hen3ry |
Posted on 01-03-2012 02:14
|
Member
Posts: 53
Joined: 26/03/2009
|
Any temporary prevention measures possible, short of shutting down the site? |
| |
|
|
| Daywalker |
Posted on 01-03-2012 03:00
|
Member
Posts: 107
Joined: 28/03/2005
|
well if the sql issues are in downloads and weblinks.php then deleting those files temporarily would work i'd suspect.
"Might and Greed will never outweigh Honor and Loyalty"
Come join us for IRC Support: Here
|
| |
|
|
| hen3ry |
Posted on 01-03-2012 04:34
|
Member
Posts: 53
Joined: 26/03/2009
|
Daywalker wrote:
well if the sql issues are in downloads and weblinks.php then deleting those files temporarily would work i'd suspect.
Ummm, that makes sense, except: I don't mind disabling those functions, but I want to avoid users getting page-not-found errors. |
| |
|
|
| Korcsii |
Posted on 14-03-2012 23:06
|
Member
Posts: 132
Joined: 22/01/2006
|
Honestly, I/we can't find any SQL injection possibilities in these files.
You may used some add-ons those were not 100% secure.
|
| |
|
|
| tixel |
Posted on 22-08-2012 02:14
|
Newbie
Posts: 2
Joined: 04/08/2012
|
connecting to prosperent.com; added add-ons on php-fusion v7.02.05, ads panel v1.02 by fangree productions and classifieds v4.08 by stars heaven. please help remove the sql injections? |
| |
|
|
| PolarFox |
Posted on 22-08-2012 12:43
|
Admin
Posts: 1503
Joined: 26/08/2008
|
please help remove the sql injections?
do you have any?
why do you think so?
|
| |
|
|
| tixel |
Posted on 23-08-2012 13:59
|
Newbie
Posts: 2
Joined: 04/08/2012
|
its okay now, i reuploaded and reinfused all of my add ons. |
| |
|
