PHP-Fusion homepage address Variable Script Injection

2004-09-25T09:26:55
ID OSVDB:10348
Type osvdb
Reporter Espen Andersson()
Modified 2004-09-25T09:26:55

Description

Vulnerability Description

PHP-Fusion contains a flaw that may allow a malicious user to execute arbitrary HTML and script code in a user's browser session in context of an affected website when a malicious profile is viewed. The issue is triggered when input passed to the "homepage address" field isn't sanitised before being stored in the user profile. It is possible that the flaw may allow an attacker to conduct script insertion attacks resulting in a loss of integrity.

Solution Description

Apply the 4.01 patch, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround: Edit the source code to ensure that input is properly sanitised.

Short Description

PHP-Fusion contains a flaw that may allow a malicious user to execute arbitrary HTML and script code in a user's browser session in context of an affected website when a malicious profile is viewed. The issue is triggered when input passed to the "homepage address" field isn't sanitised before being stored in the user profile. It is possible that the flaw may allow an attacker to conduct script insertion attacks resulting in a loss of integrity.

References:

Vendor URL: http://php-fusion.co.uk/ Secunia Advisory ID:12654 Secunia Advisory ID:12662 Related OSVDB ID: 10347