nights_shadow has discovered a vulnerability in PHP-Fusion, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed via the URL to various pages is used in maincore.php to define the constant "FUSION_QUERY", which is not properly sanitised in infusions/shoutbox_panel/shoutbox_panel.php before being returned to a user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Successful exploitation requires that the victim is logged in or that guest posts to the shoutbox are enabled.

The vulnerability is confirmed in version 6.01.10. Prior versions may also be affected.

Solution
Update to version 6.01.11.

Provided and/or discovered by
nights_shadow

Changelog
Further details available in Customer Area

Original Advisory
PHP-Fusion:
http://php-fusion.co.uk/news.php?readmore=380

nights_shadow:
http://www.xssed.com/advisory/60/PHP-FUSION_FUSION_QUERY_Cross-Site_Scripting_Vulnerability/

Deep Links
Links available in Customer Area