PT-2020-6208 · Php Fusion · Php-Fusion

Songohan22 · Published 2020-05-11 · Updated 2021-07-06 · CVE-2020-23178

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP-Fusion version 9.03.50

Description The issue in PHP-Fusion allows an attacker to perform a session replay attack and impersonate the victim user because session cookies are not deleted once a user logs out. This can lead to unauthorized access to protected information. The vulnerability is related to bypassing the authentication procedure.

Recommendations For PHP-Fusion version 9.03.50, ensure that session cookies are properly deleted upon user logout to prevent session replay attacks. As a temporary workaround, consider implementing a custom session destruction mechanism to mitigate the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-294

Related Identifiers

BDU:2021-03571

CVE-2020-23178

Affected Products

Php-Fusion

References · 6

• 🔥 https://github.com/PHPFusion/PHPFusion/issues/2314 · Exploit
• https://osv.dev/vulnerability/CVE-2020-23178 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03571 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-23178 · Security Note
• https://github.com/PHPFusion/PHPFusion/commit/0f80a6831018800d5f55d5e9068531c277e8c0b3 · Note
• https://t.me/cibsecurity/25906 · Telegram Post