CVE-2020-35687

PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim...

CVE-2020-35687

PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim...

Cross site request forgery (csrf)

PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim...

CVE-2020-35687

PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim...

CVE-2020-35687

CVE-2020-35687 affects PHPFusion CMS 9.03.90. A CSRF vulnerability in the shoutbox management allows an attacker to delete all shoutbox messages on behalf of a logged-in victim. Public PoCs/exploits exist (e.g., PacketStorm, Exploit-DB) showing a GET request triggering deletion via shoutbox_archi...

Phpfusion 跨站请求伪造漏洞

PHPFusion is a lightweight open source content management system. PHPFusion 9.03.90 suffers from a cross-site request forgery vulnerability. An attacker can exploit this vulnerability to delete all shoutbox messages on behalf of a logged-in victim...

CVE-2020-35687

PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim. Recent assessments: oosman-rak at January 20, 2021 4:08am UTC reported: Assessed Attacker Value: 3 Assessed Attacker Value: 3Assessed Attacker...

CVE-2020-35687: Cross-Site Request Forgery (CSRF)

PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim...

CVE-2020-35952

login.php in PHPFusion aka PHP-Fusion Andromeda 9.x before 2020-12-30 generates error messages that distinguish between incorrect username and incorrect password i.e., not a single "Incorrect username or password" message in both cases, which might allow enumeration...

Default credentials

login.php in PHPFusion aka PHP-Fusion Andromeda 9.x before 2020-12-30 generates error messages that distinguish between incorrect username and incorrect password i.e., not a single "Incorrect username or password" message in both cases, which might allow enumeration...

CVE-2020-35952

login.php in PHPFusion aka PHP-Fusion Andromeda 9.x before 2020-12-30 generates error messages that distinguish between incorrect username and incorrect password i.e., not a single "Incorrect username or password" message in both cases, which might allow enumeration...

CVE-2020-35952

CVE-2020-35952 affects PHPFusion (PHP-Fusion) Andromeda 9.x before 2020-12-30. The issue is that login.php generates error messages that differentiate between an incorrect username and an incorrect password, rather than a single generic message, which could enable user enumeration. The connected ...

CVE-2020-35952: Undefined Security Weakness

login.php in PHPFusion aka PHP-Fusion Andromeda 9.x before 2020-12-30 generates error messages that distinguish between incorrect username and incorrect password i.e., not a single "Incorrect username or password" message in both cases, which might allow enumeration...

PHPFusion 9.03.50 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications...

PHPFusion 9.03.50 - Persistent Cross-Site Scripting

Exploit Title: PHPFusion 9.03.50 - Persistent Cross-Site Scripting Date: 2020-05-20 Exploit Author: coiffeur Vendor Homepage: https://www.php-fusion.co.uk/home.php Software Link: https://www.php-fusion.co.uk/phpfusion9downloads.php Version: v9.03.50 How? When creating a thread or editing one of h...

phpfusion (Search Page) Denial of Service Vulnerability

phpfusion All version suffers from a denial of service vulnerability. !/usr/bin/perl @@@ @@@@@@@@@@@ @@@@@ @@@@@@@@@@ @@@ @@@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@ @@@@@@@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@@@@@@@@@ @@@ @ @@@@@@@@@@ @@@ @@@@@@ @@@...

PHPFusion Detection (HTTP)

HTTP based detection of PHPFusion. Copyright C 2009 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it...

PHPFusion数据库备份泄露漏洞 Exploit

No description provided by source. Ahmad Muammar （[email protected]）提供了如下测试方法： http://localhost/fusion/fusionadmin/updateuser.php Warning: mainfusionlangdiradmin/adminmembers.php: failed to open stream: No such file or directory in /var/www/html/fusion/fusionadmin/updateuser.php on line 14 Fatal...

phpfusion6014.txt

!/usr/bin/php -q -d shortopentag=on ? printr' -------------------------------------------------------------------------------- PHPFusion = 6.01.4 extract/SERVERREMOTEADDR sql injection exploit by rgod [email protected] site: http://retrogod.altervista.org...

phpfusion600306.txt

!/usr/bin/php -q -d shortopentag=on ? echo "PHPFusion = v6.00.306 avatar modmime arbitrary file upload &\r\n"; echo "local inclusion vulnerabilities\r\n"; echo "by rgod [email protected]\r\n"; echo "site: http://retrogod.altervista.org\r\n\r\n"; if $argc6 echo "Usage: php ".$argv0." host path us...