PT-2004-2607 · Fusion · Fusion News

Published 2004-07-30 · Updated 2024-02-08 · CVE-2004-1703

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Fusion News version 3.6.1

Description The issue allows remote attackers to add user accounts if the administrator is logged in. This can be achieved by including an img bbcode tag in a comment that calls index.php with the signup action. The action is executed when the administrator's browser loads the page containing the img tag.

Recommendations For Fusion News version 3.6.1, consider disabling the execution of the signup action in index.php to prevent unauthorized user account additions until a patch is available. Restrict access to the administrator's account and ensure that comments are thoroughly validated to prevent malicious bbcode tags.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2004-1703

Affected Products

Fusion News

References · 6

• 🔥 https://exploit-db.com/exploits/24341 · Exploit
• 🔥 http://securitytracker.com/id?1010829 · Exploit
• 🔥 http://securityfocus.com/bid/10836 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1703 · Security Note
• http://marc.info/?l=bugtraq&m=109122824523226&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16853 · Note