Fusion News 3.6.1 allows remote attackers to add user accounts, if the administrator is logged in, via a comment that contains an img bbcode tag that calls index.php with the signup action, which is executed when the administrator's browser loads the page with the img tag.

Threat-Mapped Scoring

Score: 0.0

Priority: Unclassified

EPSS

Score: 0.00572
Percentile: 0.67654

CVSS Scoring

Mapped CWE(s)

• CWE-352 : Cross-Site Request Forgery (CSRF)

All CAPEC(s)

CAPEC(s) with Mapped TTPs

Mapped ATT&CK TTPs

Affected Products

• cpe:2.3:a:fusionphp:fusion_news:3.6.1:*:*:*:*:*:*:*

← Back to Home