PHP-Fusion contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the /administration/settings_photo.php script not properly sanitizing user-supplied input to the 'thumb_compression', 'photo_watermark_text_color1', 'photo_watermark_text_color2', and 'photo_watermark_text_color3' parameters. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.
Disclosure Timeline:
Disclosure Date :2013-02-27
Vendor Solution Date :2013-02-27
Vendor Informed Date :2012-09-27
Vendor Ack Date :2012-09-27
Exploit Publish Date :2013-02-27
