Medium severity · published Jan 13, 2021
CVE-2020-35687
PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim
4.3
CVSS
1.4%
EPSS
No
On KEV
Description
PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
Phpfusion · Php-fusion
9.03.90 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-35687
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-35687
Exploit
https://github.com/PHPFusion/PHPFusion/issues/2347
Exploit
https://www.exploit-db.com/exploits/49426
More from Phpfusion
9.8
CVE-2020-37137
PHP-Fusion 9.03.50 - 'panels.php' Eval Injection
9.6
CVE-2020-23754
Cross Site Scripting (XSS) vulnerability in infusions/member_poll_panel/poll_admin.php in PHP-Fusion 9.03.50, allows attackers to execute arbitrary code, via the polls feature
8.8
CVE-2023-2453
There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘require_once’ statement
8.8
CVE-2022-3152
Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20
7.2
CVE-2021-40189
PHPFusion 9.03.110 is affected by a remote code execution vulnerability