Note added to this advisory - This is not part of PHP Fusion v5.01 This is an available mod addon supplied by the main developer Digitanium for an IIS Compatibility. This setuser.php will not implemented into PHP Fusion until v5.02 and is not mainstream accross the fusion community. I have notified the main developer Digitanium. Sheldon King PHP Fusion Beta Team Original advisory - [PersianHacker.NET 200503-10]PHP-Fusion v5.01 Html Injection Vulnerability Date: 2005 March Bug Number: 10 PHP-Fusion a light-weight open-source content management system (CMS) written in PHP. It utilises a mySQL database to store your site content and includes a simple, comprehensive adminstration system. PHP-Fusion includes the most common features you would expect to see in many other CMS packages More info @: http://php-fusion.co.uk/ Discussion: -------------------- The software does not properly validate user-supplied input in 'setuser.php'. A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the PHP-Fusion software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user. Exploit: -------------------- PHP-Fusion v5.01 Exploit

PHP-Fusion v5.01 Html Injection Exploit

XSS in register.php:

Username:

Password:

Remember Me

exmple: <script>document.write(document.cookie)</script>

 

 

www.PersianHacker.NET

Solution: -------------------- No solution was available at the time of this entry. Credit: -------------------- Discovered by PersianHacker.NET Security Team by Pi3cH (pi3ch persianhacker net) http://www.PersianHacker.NET Special Thanks: devil_box(for xss article), amectris, herbod. Help -------------------- visit: http://www.PersianHacker.NET or mail me @: pi3ch persianhacker net