logo Home

Untitled Document

Home > Archives Advisories > Articles


Fusion News Cross-Site Scripting Vulnerability
Date: 2004-04-24

Security-Corporation ID : SC-1009
URL : http://www.security-corporation.com/articles-20040424-001.html
Author : darkbicho <darkbicho@peru.com>
Product : fusion news
Source Message Contents :

=====================================================================
========================== DarkBicho ================================

PROGRAM: fusion news
HOMEPAGE: http://www.fusionphp.net/
version: 3.6.1
Bug: Cross Site Scripting
Date: 22/04/2004
Author: DarkBicho
web: http://www.darkbicho.tk
Email: darkbicho@peru.com

=====================================================================

===============
1) Introduction
===============

fusion news is sofware free in php, This product is vulnerable to the
Cross-Site Scripting vulnerability that would allow attackers to inject
HTML and script codes into the pages and execute it on the client's
browser as if it were provided by the site.


===============
2) Exploit
===============

The XSS hole is in fullnews.php

http://site
vulnerable/fullnews.php?id=<script>alert(document.cookie);</script>

===============
2) SOLUTION
===============

the vendor was notified visits web site for patch


=====================================================================
DARKBICHO
www.darkbicho.tk
Made In Peru

advisore: http://bichosoft.webcindario.com/advisory-02.txt



 

arrowSearch Advisories

arrowNewsletter

Free weekly Newsletter.

Please enter your email address here:
arrowReport Vulnerability

If you've found a vulnerability please
click here to report it.
arrowPartners

newsnow

About Us | Contact Us | Advertise | email | Backend flag
Copyright © 2016-2017 Security Corporation - All Rights Reserved - Legal - Privacy Policy