CVE-2008-5335: SQL injection vulnerability in messages.php in PHP-Fusion 6.01.15 and 7.00.1, when magic_quotes_gpc is disa...

Security readout for executives and security teams

This is an old SQL injection issue in PHP-Fusion private messaging. If an organization still runs PHP-Fusion 6.01.15 or 7.00.1 with the vulnerable condition, a remote attacker could manipulate message fields to run database commands. Exposure is likely limited to legacy PHP-Fusion deployments, especially internet-facing sites with private messaging enabled and magic_quotes_gpc disabled. Modern or upgraded deployments are not identified as affected in the provided sources. Prioritize if any public PHP-Fusion site still uses the listed legacy versions. This is not a broad modern-platform emergency, but unresolved SQL injection on an internet-facing CMS can create serious data risk. Mitigation focus: Inventory PHP-Fusion deployments and confirm exact version numbers.; Check PHP-Fusion vendor advisory and download pages for corrected release guidance.; Upgrade affected PHP-Fusion versions according to vendor guidance..

Prepared

Jun 28, 2026, 11:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.