FusionPHP Fusion News管理员命令执行漏洞

Fusion News 3.6.1版本存在漏洞。远程攻击者在管理员登陆时借助一个评论增加用户账号，该评论包含调用注册行为index.php的img bbcode标签。该漏洞在管理员的浏览器加载带有inm标签页面时执行。

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com .
@securityfocus.com>

来源: XF
名称: fusion-news-add-account(16853)
链接:http://xforce.iss.net/xforce/xfdb/16853

来源: BID
名称: 10836
链接:http://www.securityfocus.com/bid/10836

来源: SECTRACK
名称: 1010829
链接:http://securitytracker.com/id?1010829

来源: BUGTRAQ
名称: 20040729 Fusion News Yet Another Unauthorized Account Addition Vulnerability
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=109122824523226&w=2