[42259] in bugtraq
IndonesiaHack Advisory HTML injection in PHP Fusebox
daemon@ATHENA.MIT.EDU (king_purba@yahoo.co.uk)
Tue Jan 17 13:04:04 2006
Date: 17 Jan 2006 07:32:35 -0000
Message-ID: <20060117073235.11158.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: king_purba@yahoo.co.uk
To: bugtraq@securityfocus.com
IndonesiaHack Advisory HTML injection in PHP Fusebox
Author : Ph03n1X
Email : king_purba@yahoo.co.uk
Software Description
Name : PHP Fusebox 4.0.6
Vendor : http://prdownloads.sourceforge.net/php-fusebox/FB3_PHP_b6.zip?download
PoC :
http://site.xxx/fusebox/index.php?fuseaction=<h1><marquee>Halo</marquee></h1>
Vulnerable Code in file fbx_Fusebox3.0_PHP4.0.6.php :
$FB_["rawFA"] = ($attributes["fuseaction"]);
if(ListLen($FB_["rawFA"], ".") == 1 && substr($FB_["rawFA"], -1) == ".") {
$Fusebox["fuseaction"] = "Fusebox.defaultFuseaction";
}
Fix:
$FB_["rawFA"] = htmlspecialchars($attributes["fuseaction"]);
if(ListLen($FB_["rawFA"], ".") == 1 && substr($FB_["rawFA"], -1) == ".") {
$Fusebox["fuseaction"] = "Fusebox.defaultFuseaction";
}
Credit :
Zhainal, No-p****le (Bole disebut gak namanya om), All crew IndonesiaHack @ dalnet
Nanang SW, nighlogin
