CVE-2013-10018 fanzila WebFinance save_contact.php sql injection

Medium 5.5 Published 3 Feb 2023 Updated 25 Mar 2025

Attackers can inject SQL commands via contact form fields in WebFinance, potentially reading or modifying database contents.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2013-10018?

CVE-2013-10018 is a medium-severity SQL injection vulnerability in fanzila WebFinance, published on 3 Feb 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability was found in fanzila WebFinance 0.5. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file htdocs/prospection/save_contact.php. The manipulation of the argument nom/prenom/email/tel/mobile/client/fonction/note leads to sql injection. The identifier of the patch is 165dfcaa0520ee0179b7c1282efb84f5a03df114. It is recommended to apply a patch to fix this issue. The identifier VDB-220057 was assigned to this vulnerability.

Weakness: CWE-89

Which versions are affected by CVE-2013-10018?

It affects 1 product.

Products include Webfinance Project Webfinance.

How do I fix CVE-2013-10018?

No fix has been published for CVE-2013-10018 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2013-10018 being exploited?

There is no known exploitation of CVE-2013-10018 in the wild and no public exploit code.

Sources

Also known as GHSA-9v32-c484-vc8x.