CVE-2008-1918: SQL injection vulnerability in submit.php in PHP-Fusion 6.01.14 and 6.00.307, when magic_quotes_gpc is disa...

Security readout for executives and security teams

CVE-2008-1918 is an SQL injection issue in PHP-Fusion submit.php. An authenticated user could manipulate link submission data to run database commands when specific conditions are met. The business risk is mainly to legacy PHP-Fusion sites still running affected versions with vulnerable configuration. Exposure is likely limited to old PHP-Fusion deployments that still expose submit.php and allow authenticated link submissions. Modern sites are unlikely exposed unless they retain these specific legacy versions or unmaintained forks. Prioritize this if any internet-facing PHP-Fusion instance remains in service. The issue is old, but public exploit references and database impact make lingering exposure unacceptable for production systems. Mitigation focus: Inventory PHP-Fusion installations and confirm exact versions.; Check PHP-Fusion vendor guidance for fixed or unaffected releases.; Upgrade or retire affected PHP-Fusion versions where present..

Prepared

Jun 28, 2026, 19:09 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.