PHP-FUSION "FUSION_QUERY" Cross-Site Scripting Vulnerability

Monday, 2 July 2007

Discovered: 05-12-06 21:05
Released: 03-28-07

Description:
nights_shadow has discovered a vulnerability in PHP-FUSION, which could be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to the URL is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability has been confirmed in version 6.01.10, and reported in version 6.01.9. Other versions may also be affected.

Details:
The script "infusions/shoutbox_panel/shoutbox_panel.php" triggers the vulnerability:

[..]
echo "<form name='chatform' method='post' action='".FUSION_SELF.(FUSION_QUERY ? "?".str_replace("&","&amp;",FUSION_QUERY) : "")."'>
[..]

"maincore.php":

[..]
define("FUSION_QUERY", (isset($_SERVER['QUERY_STRING']) ? $_SERVER['QUERY_STRING'] : ""));
[..]

Proof of concept:
profile.php?lookup=1&'onmouseover=window.location.href='http://www.example.com

Solution:
No patch.

Edit the scripts to filter the input.

References:
http://www.xssed.com/advisory/60/PHP-FUSION_FUSION_QUERY_Cross-Site_Scripting_Vulnerability/
http://secunia.com/advisories/25907/