CVE-2013-5120

PHPFox - SQL Injection via search[gender] Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2013-5120. PoCs published by Matias Fontanini.

AI-analyzed exploit summary The document describes SQL injection vulnerabilities in PHPFox v3.6.0 (build3), specifically in the 'search[gender]' and 'search[sort_by]' parameters. It provides proof-of-concept POST requests demonstrating blind SQL injection and time-based exploitation techniques.

Description

SQL injection vulnerability in PHPFox before 3.6.0 (build4) allows remote attackers to execute arbitrary SQL commands via the search[gender] parameter to user/browse/view_/.

Exploits (1)

exploitdb WRITEUP
by Matias Fontanini · textwebappsphp
https://www.exploit-db.com/exploits/27430

The document describes SQL injection vulnerabilities in PHPFox v3.6.0 (build3), specifically in the 'search[gender]' and 'search[sort_by]' parameters. It provides proof-of-concept POST requests demonstrating blind SQL injection and time-based exploitation techniques.

Classification
Writeup 95%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: PHPFox v3.6.0 (build3)
No auth needed
Prerequisites: Access to the target application · Ability to send crafted POST requests
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/61660
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/96028
Exploit exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/27430
Exploit mailing-list x_refsource_bugtraq
http://archives.neohapsis.com/archives/bugtraq/2013-08/0048.html

Scores

EPSS 0.0122
EPSS Percentile 64.9%

Details

CWE
CWE-89
Status published
Products (1)
phpfox/phpfox 3.6.0
Published Aug 14, 2013
Tracked Since Feb 18, 2026