PT-2020-13226 · Php Fusion · Php-Fusion

Published 2020-05-07 · Updated 2020-05-14 · CVE-2020-12718

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHP-Fusion version 9.03.50

Description The issue concerns a stored XSS vulnerability in the Preview Comment feature of the administration/comments.php file. An authenticated attacker can exploit this by bypassing the protection mechanism using HTML event handlers such as ontoggle.

Recommendations For PHP-Fusion version 9.03.50, as a temporary workaround, consider disabling the Preview Comment feature until a patch is available. Restrict access to the administration/comments.php file to minimize the risk of exploitation. Avoid using HTML event handlers in the Preview Comment feature until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-12718

Affected Products

Php-Fusion

References · 3

• 🔥 https://github.com/php-fusion/PHP-Fusion/issues/2309 · Exploit
• https://osv.dev/vulnerability/CVE-2020-12718 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12718 · Security Note