PHP-Fusion contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the /downloads.php script not properly sanitizing user-supplied input to the 'orderby' parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.
Disclosure Timeline:
Vendor Informed Date :2012-09-27
Vendor Ack Date :2012-09-27
Vendor Solution Date :2013-01-27
Disclosure Date :2013-02-27
Exploit Publish Date :2013-02-27
