CVE-2004-1703

HIGH

Fusionphp Fusion News - CSRF

Title source: rule

Description

Fusion News 3.6.1 allows remote attackers to add user accounts, if the administrator is logged in, via a comment that contains an img bbcode tag that calls index.php with the signup action, which is executed when the administrator's browser loads the page with the img tag.

Exploits (1)

exploitdb WRITEUP VERIFIED
by Joseph Moniz · textwebappsphp
https://www.exploit-db.com/exploits/24341

References (4)

Scores

CVSS v3 8.8
EPSS 0.0057
EPSS Percentile 68.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Classification

CWE
CWE-352
Status draft

Affected Products (1)

fusionphp/fusion_news

Timeline

Published Jul 30, 2004
Tracked Since Feb 18, 2026