PT-2020-6332 · Unknown · Php-Fusion

Songohan22 · Published 2020-05-14 · Updated 2021-07-06 · CVE-2020-23179

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHP-Fusion version 9.03.50

Description A stored cross site scripting (XSS) vulnerability in the administration/settings main.php file allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Site footer field. This issue is related to the lack of protection measures for the web page structure, which can be exploited by remote attackers to perform cross-site scripting attacks.

Recommendations For PHP-Fusion version 9.03.50, consider disabling the ability to edit the Site footer field in administration/settings main.php until a patch is available to prevent exploitation of this issue. Restrict access to the administration/settings main.php file to minimize the risk of arbitrary web script or HTML execution. Avoid using the Site footer field in the affected administration/settings main.php file until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-04204

CVE-2020-23179

Affected Products

Php-Fusion

References · 5

• 🔥 https://github.com/PHPFusion/PHPFusion/issues/2320 · Exploit
• https://bdu.fstec.ru/vul/2021-04204 · Security Note
• https://osv.dev/vulnerability/CVE-2020-23179 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-23179 · Security Note
• https://t.me/cvenotify/17124 · Telegram Post