CSRF Vulnerability in PHPFusion 9.03.90 Allows Unauthorized Deletion of Shoutbox Messages
CVE-2020-35687

4.3MEDIUM

Key Information:

Vendor

PHP-fusion

Status
PHPfusion
Vendor
CVE Published:
13 January 2021

What is CVE-2020-35687?

PHPFusion version 9.03.90 is susceptible to a Cross-Site Request Forgery (CSRF) attack. This vulnerability allows an attacker to delete all shoutbox messages by exploiting the trust of a logged-in user. If a victim is tricked into clicking a malicious link while authenticated, the attacker can perform unauthorized actions on their behalf, compromising the integrity of the shoutbox feature.

References

https://github.com/PHPFusion/PHPFusion/issues/2347
x_refsource_MISC
https://www.exploit-db.com/exploits/49426
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.