BugTraq
IndonesiaHack Advisory HTML injection in PHP Fusebox Jan 17 2006 07:32AM
king_purba yahoo co uk
IndonesiaHack Advisory HTML injection in PHP Fusebox

Author : Ph03n1X
Email : king_purba (at) yahoo.co (dot) uk [email concealed]

Software Description
Name : PHP Fusebox 4.0.6
Vendor : http://prdownloads.sourceforge.net/php-fusebox/FB3_PHP_b6.zip?download

PoC :

http://site.xxx/fusebox/index.php?fuseaction=<h1><marquee>Halo</marquee>
</h1>

Vulnerable Code in file fbx_Fusebox3.0_PHP4.0.6.php :

$FB_["rawFA"] = ($attributes["fuseaction"]);
if(ListLen($FB_["rawFA"], ".") == 1 && substr($FB_["rawFA"], -1) == ".") {
$Fusebox["fuseaction"] = "Fusebox.defaultFuseaction";
}

Fix:

$FB_["rawFA"] = htmlspecialchars($attributes["fuseaction"]);
if(ListLen($FB_["rawFA"], ".") == 1 && substr($FB_["rawFA"], -1) == ".") {
$Fusebox["fuseaction"] = "Fusebox.defaultFuseaction";
}

Credit :

Zhainal, No-p****le (Bole disebut gak namanya om), All crew IndonesiaHack @ dalnet
Nanang SW, nighlogin

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus