Is CVE-2013-1803 actively exploited?

A proof-of-concept exploit is publicly available for CVE-2013-1803, but active exploitation has not been confirmed.

Can CVE-2013-1803 be exploited remotely?

Yes. CVE-2013-1803 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2013-1803?

CVE-2013-1803 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2013-1803

HIGHPOC

CVE-2013-1803

CWE-89Published: May 5, 2014· Updated: Jun 16, 2026

7.5

CVSS v3.1

Official Description

Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) orderby parameter to downloads.php; or remote authenticated users with certain permissions to execute arbitrary SQL commands via a (2) parameter name starting with "delete_attach_" in an edit action to forum/postedit.php; the (3) poll_opts[] parameter in a newthread action to forum/postnewthread.php; the (4) pm_email_notify, (5) pm_save_sent, (6) pm_inbox, (7) pm_sentbox, or (8) pm_savebox parameter to administration/settings_messages.php; the (9) thumb_compression, (10) photo_watermark_text_color1, (11) photo_watermark_text_color2, or (12) photo_watermark_text_color3 parameter to administration/settings_photo.php; the (13) enable parameter to administration/bbcodes.php; the (14) news_image, (15) news_image_t1, or (16) news_image_t2 parameter to administration/news.php; the (17) news_id parameter in an edit action to administration/news.php; or the (18) article_id parameter in an edit action to administration/articles.php. NOTE: the user ID cookie issue in Authenticate.class.php is already covered by CVE-2013-7375.

NVD Source

Technical Analysis

CVE-2013-1803 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A proof-of-concept (PoC) exploit exists for CVE-2013-1803. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.

From a weakness classification perspective (CWE-89): SQL injection vulnerabilities allow attackers to manipulate database queries, potentially exposing or modifying sensitive data.