CVE-2004-1703

moderate-risk

Published 2004-07-30

Fusion News 3.6.1 allows remote attackers to add user accounts, if the administrator is logged in, via a comment that contains an img bbcode tag that calls index.php with the signup action, which is executed when the administrator's browser loads the page with the img tag.

Do I need to act?

0.57% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

1 public exploit available

24341

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.8/10 High

NETWORK / LOW complexity

Affected Products (1)

Fusion News

Affected Vendors

Fusionphp

References (8)

Mailing List http://marc.info/?l=bugtraq&m=109122824523226&w=2

Broken Link http://securitytracker.com/id?1010829

Broken Link http://www.securityfocus.com/bid/10836

Third Party Advisory https://exchange.xforce.ibmcloud.com/vulnerabilities/16853

Mailing List http://marc.info/?l=bugtraq&m=109122824523226&w=2

Broken Link http://securitytracker.com/id?1010829

Broken Link http://www.securityfocus.com/bid/10836

Third Party Advisory https://exchange.xforce.ibmcloud.com/vulnerabilities/16853

/ 100

moderate-risk

Severity 30/34 · Critical

Exploitability 9/34 · Low

Exposure 5/34 · Minimal