Critical: Highly critical

Impact: Cross Site Scripting

Where: Remote

Solution Status: Vendor Patch

A vulnerability has been reported in glFusion, which can be exploited by malicious people to conduct script insertion attacks.

Input passed via the “username” parameter to lib-comment.php is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in the context of an affected site when the malicious comment is viewed.

Successful exploitation of this vulnerability requires that anonymous comments are enabled.

This vulnerability is reported in version 1.1.1. Other versions may also be affected.

Apply security update.

http://www.glfusion.org/article.php/xsscomments

This vulnerability has been fixed in glFusion v1.1.2 and later versions

Bjarne Mathiesen Schacht

CVE-2009-0455