PT-2007-4817 · Php Fusion · Php-Fusion

Nights_Shadow · Publicado 2007-07-04 · Atualizado 2017-07-29 · CVE-2007-3559

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP-Fusion versions 6.01.9 through 6.01.10

Description The issue is related to a cross-site scripting (XSS) vulnerability. It allows remote authenticated users to inject arbitrary web script or HTML via the URI when guest posts are enabled. This is related to the FUSION QUERY constant.

Recommendations For PHP-Fusion versions 6.01.9 through 6.01.10, consider disabling guest posts in the shoutbox panel to minimize the risk of exploitation until a patch is available. Restrict access to the infusions/shoutbox panel/shoutbox panel.php file to prevent malicious injections.

Correção

Identificadores relacionados

CVE-2007-3559

Produtos afetados

Php-Fusion

Referências · 7

• http://xssed.com/advisory/60/PHP-FUSION_FUSION_QUERY_Cross-Site_Scripting_Vulnerability · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3559 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35225 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-3559 · Nota de Segurança
• http://osvdb.org/36342 · Nota
• http://secunia.com/advisories/25907 · Aviso do Fabricante
• http://securityfocus.com/bid/24733 · Nota