bugtraq - IndonesiaHack Advisory HTML injection in PHP Fusebox

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060117073235.11158.qmail@securityfocus.com>
Date: 17 Jan 2006 07:32:35 -0000
From: king_purba@...oo.co.uk
To: bugtraq@...urityfocus.com
Subject: IndonesiaHack Advisory HTML injection in PHP Fusebox


IndonesiaHack Advisory HTML injection in PHP Fusebox

Author : Ph03n1X
Email  : king_purba@...oo.co.uk

Software Description
Name   : PHP Fusebox 4.0.6
Vendor : http://prdownloads.sourceforge.net/php-fusebox/FB3_PHP_b6.zip?download

PoC :

http://site.xxx/fusebox/index.php?fuseaction=<h1><marquee>Halo</marquee></h1>

Vulnerable Code in file fbx_Fusebox3.0_PHP4.0.6.php :

$FB_["rawFA"] = ($attributes["fuseaction"]);
if(ListLen($FB_["rawFA"], ".") == 1 && substr($FB_["rawFA"], -1) == ".") {
        $Fusebox["fuseaction"] = "Fusebox.defaultFuseaction";
}


Fix:

$FB_["rawFA"] = htmlspecialchars($attributes["fuseaction"]);
if(ListLen($FB_["rawFA"], ".") == 1 && substr($FB_["rawFA"], -1) == ".") {
        $Fusebox["fuseaction"] = "Fusebox.defaultFuseaction";
}


Credit :

Zhainal, No-p****le (Bole disebut gak namanya om), All crew IndonesiaHack @ dalnet
Nanang SW, nighlogin