PHP-Fusion Viewthread.PHP Information Disclosure Vulnerbility

Bugtraq ID:	12482
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 08 2005 12:00AM
Updated:	Feb 08 2005 12:00AM
Credit:	Discovery of this vulnerability is credited to TheGreatOne2176, Reapercore.
Vulnerable:	PHP-Fusion PHP-Fusion 4.0 1 PHP-Fusion PHP-Fusion 4.00
Not Vulnerable:

PHP-Fusion Viewthread.PHP Information Disclosure Vulnerbility

PHP-Fusion is reportedly affected by an information disclosure vulnerability. This issue is due to the application failing to properly sanitize user-supplied input.

It is reported that an attacker could leverage this vulnerability to view any thread of protected forums on an affected version of the application. All PHP-Fusion 4 versions are reportedly affected by this vulnerability; earlier versions may also be vulnerable.

PHP-Fusion Viewthread.PHP Information Disclosure Vulnerbility

No exploit is required and the following proof of concept is available:
http://www.example.com/fusion_forum/viewthread.php?forum_id=10000&forum_cat=100000&thread_id=2

PHP-Fusion Viewthread.PHP Information Disclosure Vulnerbility

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

PHP-Fusion Viewthread.PHP Information Disclosure Vulnerbility

References:

• PHP-Fusion Homepage (PHP-Fusion)
  
• Vulnerability in PHP-Fusion (TheGreatOne2176, Reapercore)