#5 HTML injection in PHP Fusebox

[Anonymous]

http://site.xxx/fusebox/index.php?fuseaction=<h1><marquee>Halo</marquee></h1>

Vulnerable Code in file fbx_Fusebox3.0_PHP4.0.6.php :

$FB_["rawFA"] = ($attributes["fuseaction"]);
if(ListLen($FB_["rawFA"], ".") == 1 &&
substr($FB_["rawFA"], -1) == ".") {
$Fusebox["fuseaction"] =
"Fusebox.defaultFuseaction";
}

Fix:

$FB_["rawFA"] =
htmlspecialchars($attributes["fuseaction"]);
if(ListLen($FB_["rawFA"], ".") == 1 &&
substr($FB_["rawFA"], -1) == ".") {
$Fusebox["fuseaction"] =
"Fusebox.defaultFuseaction";
}