Multiple SQL injection and cross-site scripting vulnerabilities in PHP-Fusion

Release date:
Updated on: 2013-03-01

Affected Systems:
PHP-Fusion 7.x
Description:
--------------------------------------------------------------------------------
Bugtraq id: 58226

PHP-Fusion is a lightweight open-source content management system written in PHP 5.

PHP-Fusion 7.02.05 has a security vulnerability. Attackers can exploit this vulnerability to execute SQL injection and cross-site scripting.

1) The parameter values of "news_id", "news_image", "news_image_t1", "news_image_t2" in administration/news. php are not properly filtered, resulting in arbitrary SQL code injection.

Successful exploitation requires the permission to manage news.

2) The "article_id" parameter value of administration/articles. php is not properly filtered, resulting in arbitrary SQL code injection.

You need to manage the article permission for successful exploitation.

3) The "highlight" parameter value of forum/viewthread. php (when "thread_id" is set to a valid forum thread identifier) is not properly filtered, resulting in arbitrary HTML and script code execution.

<* Source: Janek Vind (come2waraxe@yahoo.com)

Link: http://secunia.com/advisories/52403/
Http://www.waraxe.us/advisory-97.html
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

PHP-Fusion
----------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.php-fusion.co.uk/news.php