PT-2004-2607 · Fusion · Fusion News

CVE-2004-1703 · Publicado 2004-07-30 · Atualizado 2024-02-08

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Fusion News version 3.6.1

Description The issue allows remote attackers to add user accounts if the administrator is logged in. This can be achieved by including an img bbcode tag in a comment that calls index.php with the signup action. The action is executed when the administrator's browser loads the page containing the img tag.

Recommendations For Fusion News version 3.6.1, consider disabling the execution of the signup action in index.php to prevent unauthorized user account additions until a patch is available. Restrict access to the administrator's account and ensure that comments are thoroughly validated to prevent malicious bbcode tags.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2004-1703

Produtos afetados

Fusion News

Referências · 6

• 🔥 https://exploit-db.com/exploits/24341 · Exploit
• 🔥 http://securitytracker.com/id?1010829 · Exploit
• 🔥 http://securityfocus.com/bid/10836 · Exploit
• http://marc.info/?l=bugtraq&m=109122824523226&w=2 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16853 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-1703 · Nota de Segurança