https://www.exploit-db.com/exploits/26102
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200510-050

)PHP-Fusion是一个轻量级开源内容管理系统PHP-Fusion的messages.php存在SQL注入漏洞。远程攻击者可以借助msg_view参数执行任意SQL指令。

source: http://www.securityfocus.com/bid/14489/info

PHP-Fusion is prone to an SQL injection vulnerability.

This issue is due to a failure in the application to properly sanitize user-supplied input to the 'messages.php' script before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/messages.php?msg_view='

来源:BID
名称:14489
链接:http://www.securityfocus.com/bid/14489
来源:MISC
链接:http://www.s4a.cc/forum/archive/index.php/t-3585.html
来源:OSVDB
名称:18708
链接:http://www.osvdb.org/18708
来源:BUGTRAQ
名称:20050930Re:PHP-Fusionv6.00.109SQLInjection/admin|userscredentials
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=112811077320676&w;=2