CVE-2020-37152
BaseFortify
Publication date: 2026-02-05
Last updated on: 2026-02-09
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| php-fusion | phpfusion | 9.03.50 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects PHP-Fusion version 9.03.50 in the file panels.php. It is a cross-site scripting (XSS) vulnerability that occurs because the application does not properly sanitize user input submitted via the 'panel_content' POST parameter. An attacker can exploit this by submitting specially crafted input to this parameter, which results in the execution of arbitrary malicious JavaScript code within the context of the affected website.
How can this vulnerability impact me? :
The impact of this vulnerability is that an attacker can inject and execute malicious scripts in the browser of users visiting the affected site. This can lead to various attacks such as stealing user session cookies, defacing the website, redirecting users to malicious sites, or performing actions on behalf of the user without their consent.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability in PHP-Fusion 9.03.50 involves cross-site scripting (XSS) via the 'panel_content' POST parameter in panels.php. Detection involves testing if crafted input submitted to the 'panel_content' field results in execution of arbitrary JavaScript in the browser.
To detect this vulnerability, you can attempt to submit a test payload containing JavaScript code (e.g., <script>alert('XSS')</script>) via a POST request to panels.php targeting the 'panel_content' parameter and observe if the script executes in the browser.
Example command using curl to test the vulnerability:
- curl -X POST -d "panel_content=<script>alert('XSS')</script>" http://[target]/panels.php -v
If the alert box appears or the script executes, the vulnerability is present.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the cross-site scripting vulnerability in PHP-Fusion 9.03.50, immediate steps include sanitizing and validating all user input, especially the 'panel_content' POST parameter, before rendering it in the browser.
Applying patches or updates from the vendor that address this vulnerability is recommended once available.
As a temporary workaround, consider implementing web application firewall (WAF) rules to detect and block malicious scripts in POST requests targeting panels.php.