PT-2021-17838 · Unknown · Php-Fusion

Meangcz · Published 2021-04-29 · Updated 2022-04-25 · CVE-2021-28280

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: PHPFusion version 9.03.110

Description: The issue concerns a combination of CSRF and Cross-site scripting (XSS) vulnerability in the search.php file. This allows remote attackers to inject arbitrary web script or HTML, potentially leading to unauthorized actions or data exposure.

Recommendations: For PHPFusion version 9.03.110, consider updating to a newer version that addresses this issue, or as a temporary workaround, restrict access to the search.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

CSRF

Weakness Enumeration

CWE-79

CWE-352

Related Identifiers

CVE-2021-28280

Affected Products

Php-Fusion

References · 7

• 🔥 https://anotepad.com/notes/2skndayt · Exploit
• https://github.com/PHPFusion/PHPFusion/commit/da9f89ae70219f357fba6fffd2dae1ec886d8a3b · Patch
• https://github.com/PHPFusion/PHPFusion/commit/fda266c3bb35c650a8c4c51b6923abdfb66ef5cd · Patch
• https://github.com/PHPFusion/PHPFusion/commit/08d6c2ea49bd06fcce32275252f5f25abe61965c · Patch
• https://github.com/PHPFusion/PHPFusion/commit/1c2b32321cf11ed1cd3ff835f8da0d172c849ce6 · Patch
• https://osv.dev/vulnerability/CVE-2021-28280 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28280 · Security Note