I don't have PHP-Fusion, but I do have a question for you. Have you tried
URL=javascript:alert(document.cookie)? If that works, then you have a cross
site scripting vulnerability.

Regards,
Paul
Greyhats Security
http://greyhatsecurity.org

-----Original Message-----
From: peanut (at) black-rat.no-ip (dot) com [email concealed] [mailto:peanut (at) black-rat.no-ip (dot) com [email concealed]]
Sent: Monday, October 24, 2005 12:44 PM
To: bugtraq (at) securityfocus (dot) com [email concealed]
Subject: Possible Bug in PHP-Fusion 6.0.204

There is a Bug in The News-System:
Post something like:
<me<meta>ta http-equiv = "refresh" content = "1; URL =
http://www.google.com">
and you'll be redirected to google.

Possible Solution: use a recursive function to filter metatags.

--
No virus found in this incoming message.
Checked by AVG Free Edition.
Version: 7.1.361 / Virus Database: 267.12.5/147 - Release Date: 10/24/2005

--
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.1.361 / Virus Database: 267.12.5/147 - Release Date: 10/24/2005

[ reply ]