PT-2021-10940 · Unknown · Php-Fusion

Published 2021-11-02 · Updated 2021-11-03 · CVE-2020-23754

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: PHP-Fusion version 9.03.50

Description: The issue is related to a Cross Site Scripting (XSS) vulnerability, which allows attackers to execute arbitrary code via the polls feature. This is made possible through the poll admin.php file in the infusions/member poll panel directory.

Recommendations: For PHP-Fusion version 9.03.50, consider disabling the polls feature until a patch is available to prevent exploitation of the XSS vulnerability. Restrict access to the poll admin.php file to minimize the risk of arbitrary code execution.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-23754

Affected Products

Php-Fusion

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-23754 · Security Note
• https://osv.dev/vulnerability/CVE-2020-23754 · Vendor Advisory
• https://github.com/php-fusion/PHP-Fusion/issues/2315 · Note
• https://t.me/cibsecurity/31622 · Telegram Post
• https://user-images.githubusercontent.com/62001260/81574006-6fb70480-93cf-11ea-814c-55a96d2fe95e.PNG · Note
• https://user-images.githubusercontent.com/62001260/81574112-9412e100-93cf-11ea-9493-615a70162034.PNG · Note