CVE-2013-1804: XSS
Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbitrary web script or HTML via the (1) highlight parameter to forum/viewthread.php; or remote authenticated users with certain permissions to inject arbitrary web script or HTML via the (2) userlist or (3) usertypes parameter to messages.php; (4) message parameter to infusions/shoutboxpanel/shoutboxadmin.php; (5) message parameter to administration/news.php; (6) panellist parameter to administration/paneleditor.php; (7) HTTP User Agent string to administration/phpinfo.php; (8) "BBCODE" parameter to administration/bbcodes.php; errorMessage parameter to (9) articlecats.php, (10) downloadcats.php, (11) newscats.php, or (12) weblinkcats.php in administration/, when error is 3; or (13) body or (14) body2 parameter to administration/articles.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1804?
CVE-2013-1804 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2013-1804?
To fix CVE-2013-1804, upgrade PHP-Fusion to version 7.02.06 or later.
What are the affected versions in CVE-2013-1804?
CVE-2013-1804 affects PHP-Fusion versions prior to 7.02.06, including 7.02.01 to 7.02.05.
What types of attacks are possible with CVE-2013-1804?
CVE-2013-1804 allows remote attackers to perform cross-site scripting (XSS) attacks to inject arbitrary web scripts or HTML.
Who is at risk from CVE-2013-1804?
Users of PHP-Fusion versions 7.02.05 and earlier are at risk from CVE-2013-1804 vulnerabilities.