Bugtraq mailing list archives
RE: Possible Bug in PHP-Fusion 6.0.204
From: "Paul" <pvnick () gmail com>
Date: Mon, 24 Oct 2005 22:41:09 -0400
I don't have PHP-Fusion, but I do have a question for you. Have you tried URL=javascript:alert(document.cookie)? If that works, then you have a cross site scripting vulnerability. Regards, Paul Greyhats Security http://greyhatsecurity.org -----Original Message----- From: peanut () black-rat no-ip com [mailto:peanut () black-rat no-ip com] Sent: Monday, October 24, 2005 12:44 PM To: bugtraq () securityfocus com Subject: Possible Bug in PHP-Fusion 6.0.204 There is a Bug in The News-System: Post something like: <me<meta>ta http-equiv = "refresh" content = "1; URL = http://www.google.com"> and you'll be redirected to google. Possible Solution: use a recursive function to filter metatags. -- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.1.361 / Virus Database: 267.12.5/147 - Release Date: 10/24/2005 -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.361 / Virus Database: 267.12.5/147 - Release Date: 10/24/2005
Current thread:
- Possible Bug in PHP-Fusion 6.0.204 peanut (Oct 24)
- RE: Possible Bug in PHP-Fusion 6.0.204 Paul (Oct 25)