CVE-2005-4655 in PHP-Fusion
Summary
by MITRE
Cross-site scripting (XSS) vulnerability in submit.php in PHP-Fusion 6.0.204 allows remote attackers to inject arbitrary web script or HTML via nested tags in the news_body parameter, as demonstrated by elements such as "<me<meta>ta" and "<sc<script>ript>".
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/05/2017
The vulnerability identified as CVE-2005-4655 represents a critical cross-site scripting flaw in PHP-Fusion version 6.0.204's submit.php script. This security weakness resides in the application's handling of user input within the news_body parameter, creating an avenue for remote attackers to execute malicious web scripts or HTML code within the context of other users' browsers. The vulnerability specifically manifests when nested HTML tags are submitted through the news_body field, demonstrating the exploitation potential through crafted payloads such as "<me<meta>ta" and "<sc<script>ript>" that bypass conventional input sanitization mechanisms.
The technical implementation of this vulnerability stems from inadequate input validation and output encoding practices within the PHP-Fusion content management system. When the application processes the news_body parameter without proper sanitization of nested HTML tags, it fails to distinguish between legitimate user content and potentially malicious script code. This flaw directly maps to CWE-79, which categorizes cross-site scripting vulnerabilities as weaknesses in web applications that allow attackers to inject client-side scripts into web pages viewed by other users. The nested tag exploitation technique leverages the browser's parsing behavior where malformed or nested HTML elements can be interpreted differently than intended, creating opportunities for script execution.
From an operational perspective, this vulnerability presents significant risks to organizations using PHP-Fusion 6.0.204 as their content management platform. Attackers could leverage this flaw to steal session cookies, redirect users to malicious websites, deface the website content, or perform actions on behalf of authenticated users. The impact extends beyond simple data theft to include potential privilege escalation and persistent malicious presence within the application. The demonstrated payloads show sophisticated understanding of HTML parsing behavior, indicating that attackers can craft inputs that appear benign but execute malicious code when rendered by victim browsers.
Security practitioners should implement immediate mitigations including input sanitization of all user-supplied content, particularly within form fields that support rich text or HTML content. The recommended approach involves implementing proper HTML entity encoding for all output, utilizing content security policies to restrict script execution, and applying input validation that strips or escapes dangerous HTML tags and attributes. Organizations should also consider implementing web application firewalls to detect and block suspicious input patterns, while ensuring that all PHP-Fusion installations are updated to patched versions that address this vulnerability. The ATT&CK framework categorizes this as a web application vulnerability exploitation technique under the T1190 category, which encompasses exploitation of vulnerabilities in web applications to execute arbitrary code or gain unauthorized access to system resources.