Fusion News 3.3 - Unauthorized Account Addition

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1054102 漏洞类型
发布时间 2003-08-18 更新时间 2003-08-18
CVE编号 N/A CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/23039
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/8441/info

Fusion News is prone to an access validation error allowing a user to add arbitrary user/administrator accounts through manipulating URI parameters.

Successful exploitation of this error may allow a user to compromise a vulnerable system by gaining administrative privileges.

The problem is reported to be present in Fusion News 3.3, however older versions may be vulnerable as well. 

http://www.example.com/FusionNews/?
id=signup&username=DarkKnight&email=EMAIL@EMAIL.COM+&password=123456&icon=
&le=3