CVE-2013-1806

CVE-2013-1806 describes multiple directory traversal vulnerabilities in PHP-Fusion versions prior to 7.02.06. These flaws allow remote authenticated users to execute arbitrary files by manipulating the 'user_theme' parameter in maincore.php. Additionally, authenticated administrators can delete arbitrary files through the 'enable' parameter in administration/user_fields.php or the 'file' parameter in administration/db_backup.php. The vulnerability has a CVSS score of 6.5, indicating a medium severity. It can be exploited with low attack complexity over the network by authenticated users, potentially leading to partial compromise of confidentiality, integrity, and availability. The FAUCET Risk Score is high at 95/100, and its EPSS score suggests a higher-than-average likelihood of exploitation compared to other CVEs. While there is no evidence of active exploitation in the wild (no KEV entry), an exploit for this vulnerability is publicly available on ExploitDB (EDB-24562). Despite this, there is no recorded community discussion or media coverage, which is typical for a large percentage of CVEs.