PT-2020-6388 · Unknown · Php-Fusion

Songohan22 · Published 2020-05-15 · Updated 2021-07-06 · CVE-2020-23181

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHP-Fusion version 9.03.60

Description The issue is related to a reflected cross site scripting (XSS) vulnerability in the /administration/theme.php file of PHP-Fusion. This vulnerability can be exploited by authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Manage Theme field. The vulnerability exists due to insufficient protection of the web page structure.

Recommendations For PHP-Fusion version 9.03.60, consider disabling access to the /administration/theme.php file until a patch is available. Restrict access to the Manage Theme field to minimize the risk of exploitation. Avoid using the Manage Theme field in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-04466

CVE-2020-23181

Affected Products

Php-Fusion

References · 6

• 🔥 https://github.com/phpfusion/PHPFusion/issues/2326 · Exploit
• https://osv.dev/vulnerability/CVE-2020-23181 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-23181 · Security Note
• https://bdu.fstec.ru/vul/2021-04466 · Security Note
• https://vuldb.com/?id.177918 · Note
• https://t.me/cvenotify/17123 · Telegram Post