Description
Multiple cross-site scripting (XSS) vulnerabilities in submit.php in PHP-Fusion before 6.01.3 allow remote attackers to inject arbitrary web script or HTML by using edit_profile.php to upload a (1) avatar or (2) forum image attachment that has a .gif or .jpg extension, and begins with a GIF header followed by JavaScript code, which is executed by Internet Explorer.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.securityfocus.com/archive/1/438938/100/0/threaded ↗
- http://www.securityfocus.com/bid/18787 ↗
- http://www.vupen.com/english/advisories/2006/2655 ↗
- http://securityreason.com/securityalert/1224 ↗
- http://secunia.com/advisories/20904 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27537 ↗
- http://php-fusion.co.uk/news.php ↗