8.8high
CVE-2004-17031 exploit
Fusion News 3.6.1 allows remote attackers to add user accounts, if the administrator is logged in, via a comment that contains an img bbcod…
Published 22 y ago · modified 4 mo ago · JSON
CVSS
8.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
2.0%
percentile 80%
Public exploits
1
Exploit-DB
Summary
Fusion News 3.6.1 allows remote attackers to add user accounts, if the administrator is logged in, via a comment that contains an img bbcode tag that calls index.php with the signup action, which is executed when the administrator's browser loads the page with the img tag.
Exploit prediction (EPSS)
1.96% probability of exploitation in the next 30 days, higher than 80% of all scored CVEs.
Exploits and detections
- EDB-24341 Fusionphp Fusion News 3.3/3.6 - Administrator Command Execution · webapps · 2004-07-30
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
- CWE-352 Cross-Site Request Forgery
References
- marc.info /?l=bugtraq&m=109122824523226&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
- securityfocus.com /bid/10836 · vdb-entry, x_refsource_BID, x_transferred
- securitytracker.com /id?1010829 · vdb-entry, x_refsource_SECTRACK, x_transferred
- exchange.xforce.ibmcloud.com /vulnerabilities/16853 · vdb-entry, x_refsource_XF, x_transferred
Sources
- CVE List: CVE-2004-1703
- NVD: CVE-2004-1703
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.