Secunia

slacker4ever_1 has discovered a vulnerability in PHP-Fusion, which can be exploited by malicious people to conduct script insertion attacks.

Input passed in nested "url" BBcode tags isn't properly sanitised before being used in a post. This can be exploited to inject arbitrary script code, which is executed in a user's browser session in context of an affected site when the malicious post is viewed.

Example:
text[url=[url= onmouseover=[code];//]][/url][/url]

The vulnerability has been confirmed in version 6.00.107. Other versions may also be affected.

Solution
Apply patch.
Further details available in Customer Area

Provided and/or discovered by
slacker4ever_1

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area