Unpatched releases of V4.0 allow the user to access the Template banning.cfm without any administrative privleages. All users of the software should check with fusetalk.com for the latest security patches to prevent this being misused.
Access to this template allows any user to ban any other users and seems to be particularly vunerable. Fortunately it does not affect the administration templates, merely the moderation ones so the chances of an attacker gaining higher levels of access seem unlikely.
Another issue seems to exist which I have only so far tested on Version 2.0 and am unsure if this also occurs in V3-4, it appears that within the administration templates adduser.cfm allows parameters to be passed by a get statement rather than a post statement.
This potential vunerability could allow a hostile to create a new account by tricking some other person with moderator powers. Although it may seem obvious that a link to
would create a new account, if the adress is hidden within an image tag [img][/img] then the event will fire the creation of the account when the administrators web browser attempts to download the image.
This could be extended by the variable FTVAR_SCRIPTRUN=self.close which even in not creating an account would be capable running malicious javascript when an administrative user attempted to follow the link.
Since fusetalk relies nearly entirely on POST based data the best fix for this is to restrict posting of data by a GET statement.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
