Description
A SQL injection vulnerability exists in the vArcade 1.8 module for PHP-Fusion CMS. The comment_id parameter is not properly sanitized before being used in SQL queries.
Impact
Attackers can inject arbitrary SQL commands to extract sensitive data from the database, including user credentials and site configuration. This can lead to complete compromise of the PHP-Fusion installation.
Solution
Apply input validation to the comment_id parameter or upgrade to a patched version of the vArcade module.