CVE-2020-37152: PHP-Fusion 9.03.50 panels.php - Cross-Site Scripting (XSS)
PHP-Fusion 9.03.50 panels.php is vulnerable to cross-site scripting (XSS) via the 'panelcontent' POST parameter. The application fails to properly sanitize user input before rendering it in the browser, allowing attackers to inject arbitrary JavaScript. This can be exploited by submitting crafted input to the 'panelcontent' field in panels.php, resulting in execution of malicious scripts in the context of the affected site.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-37152?
CVE-2020-37152 is considered a medium severity vulnerability due to its potential to allow attackers to execute malicious scripts in users' browsers.
How do I fix CVE-2020-37152?
To fix CVE-2020-37152, update PHP-Fusion to the latest version where the input sanitization issue has been addressed.
Which versions of PHP-Fusion are affected by CVE-2020-37152?
CVE-2020-37152 affects PHP-Fusion version 9.03.50.
How does CVE-2020-37152 work?
CVE-2020-37152 allows cross-site scripting (XSS) attacks through unsanitized user input in the 'panel_content' POST parameter.
What are the risks associated with CVE-2020-37152?
The risks associated with CVE-2020-37152 include potential data theft, session hijacking, and spreading malware via compromised sessions.