[40883] in bugtraq
RE: Possible Bug in PHP-Fusion 6.0.204
daemon@ATHENA.MIT.EDU (Paul)
Tue Oct 25 18:59:19 2005
From: "Paul" <pvnick@gmail.com>
To: <peanut@black-rat.no-ip.com>, <bugtraq@securityfocus.com>
Date: Mon, 24 Oct 2005 22:41:09 -0400
MIME-Version: 1.0
Content-Type: text/plain;
charset="windows-1250"
Content-Transfer-Encoding: 7bit
In-Reply-To: <20051024164425.2853.qmail@securityfocus.com>
Message-ID: <435d9b47.62a2fd77.5714.0669@mx.gmail.com>
I don't have PHP-Fusion, but I do have a question for you. Have you tried
URL=javascript:alert(document.cookie)? If that works, then you have a cross
site scripting vulnerability.
Regards,
Paul
Greyhats Security
http://greyhatsecurity.org
-----Original Message-----
From: peanut@black-rat.no-ip.com [mailto:peanut@black-rat.no-ip.com]
Sent: Monday, October 24, 2005 12:44 PM
To: bugtraq@securityfocus.com
Subject: Possible Bug in PHP-Fusion 6.0.204
There is a Bug in The News-System:
Post something like:
<me<meta>ta http-equiv = "refresh" content = "1; URL =
http://www.google.com">
and you'll be redirected to google.
Possible Solution: use a recursive function to filter metatags.
--
No virus found in this incoming message.
Checked by AVG Free Edition.
Version: 7.1.361 / Virus Database: 267.12.5/147 - Release Date: 10/24/2005
--
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.1.361 / Virus Database: 267.12.5/147 - Release Date: 10/24/2005
