Intrusion Prevention

PHP-Fusion.Administration.Banner.Stored.XSS

Description

This indicates an attack attempt to exploit an Input Validation Error Vulnerability in PHP-Fusion.
The vulnerability is due to improper validation of user input in HTTP requests. A remote authenticated attacker can exploit the vulnerability by sending a crafted request to the vulnerable server. Successful exploitation could result in the execution of script code in the security context of the target user's browser, when the user visits the page.

Affected Products

PHP-Fusion prior to 9.03.60

Impact

System Compromise: Remote attackers can execute arbitrary script code in the context of the affected application.

Recommended Actions

Apply the most recent upgrade or patch from the vendor.
https://github.com/php-fusion/PHP-Fusion/commit/c36006f900d855f1173f81cea1a774295049f4d8

CVE References

CVE-2020-12438