CVE-2020-37152: PHP-Fusion 9.03.50 XSS Vulnerability

CVE-2020-37152 Overview

CVE-2020-37152 is a stored cross-site scripting (XSS) vulnerability in PHP-Fusion 9.03.50, a free open-source content management system. The flaw resides in panels.php, which fails to sanitize the panel_content POST parameter before rendering it back to the browser. Authenticated attackers with panel management privileges can inject arbitrary JavaScript that executes in the context of any user who views the affected panel. The vulnerability is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact

Successful exploitation allows attackers to execute JavaScript in victims' browsers, enabling session hijacking, credential theft, and unauthorized actions against the PHP-Fusion site.

Affected Products

• PHP-Fusion 9.03.50
• Component: panels.php
• Vulnerable parameter: panel_content (POST)

Discovery Timeline

• 2026-02-05 - CVE-2020-37152 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2020-37152

Vulnerability Analysis

The vulnerability stems from missing output encoding when PHP-Fusion 9.03.50 renders panel content supplied through the administrative panel editor. The application accepts the panel_content POST parameter in panels.php and stores it for later display without applying HTML entity encoding or input filtering. When a user navigates to a page that renders the affected panel, the injected payload executes in their browser session.

Because panels are reusable site components, the injected JavaScript runs in the context of every page that includes the compromised panel. This expands the blast radius beyond a single victim to any visitor encountering the panel, including administrators. EPSS data places this vulnerability in a low-probability exploitation tier, but the impact on session integrity remains relevant for hardened deployments.

Root Cause

The root cause is improper neutralization of user-supplied input during HTML output generation [CWE-79]. PHP-Fusion does not apply functions such as htmlspecialchars() or context-aware encoding to the panel_content value before reflecting it inside the rendered HTML. The application trusts that privileged users will not submit malicious markup, which is an inadequate security boundary against compromised or low-privilege staff accounts.

Attack Vector

Exploitation requires network access to the PHP-Fusion administrative interface and authenticated access with panel-editing privileges. The attacker submits a crafted POST request to panels.php containing JavaScript inside the panel_content field. Any subsequent visitor who loads a page rendering the panel triggers the script. User interaction is required for the payload to execute, since a victim must visit the affected page. Technical exploitation details are documented in the Exploit-DB #48299 entry and the VulnCheck Advisory on XSS.

Detection Methods for CVE-2020-37152

Indicators of Compromise

• POST requests to panels.php containing HTML tags such as <script>, <img onerror=>, or <svg onload=> inside the panel_content parameter.
• Unexpected outbound requests from user browsers to attacker-controlled domains after viewing pages with custom panels.
• New or modified panel records in the PHP-Fusion database containing JavaScript event handlers or external script references.

Detection Strategies

• Inspect web server access logs for POST submissions to /administration/panels.php from accounts that do not normally manage panels.
• Deploy a web application firewall (WAF) rule that flags HTML or JavaScript syntax in the panel_content POST body.
• Run database queries against the panels table to identify stored entries containing <script, javascript:, or common XSS payload patterns.

Monitoring Recommendations

• Alert on administrative account activity occurring outside business hours or from unusual IP ranges.
• Monitor browser-side Content Security Policy (CSP) violation reports for inline script execution on PHP-Fusion pages.
• Track changes to PHP-Fusion panel tables through database audit logging to detect unauthorized modifications.

How to Mitigate CVE-2020-37152

Immediate Actions Required

• Upgrade PHP-Fusion to a release later than 9.03.50 that addresses the panel_content sanitization gap.
• Audit existing panels for embedded JavaScript or HTML event handlers and remove untrusted content.
• Restrict panel administration privileges to a minimum set of trusted accounts and enforce strong authentication.

Patch Information

No specific vendor advisory URL is listed in the NVD entry. Administrators should consult the PHP-Fusion Official Site for the latest release notes and apply the most recent stable version. Review the VulnCheck Advisory on XSS for additional remediation guidance.

Workarounds

• Deploy a Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
• Place the PHP-Fusion administrative interface behind a WAF that filters HTML and JavaScript syntax in POST bodies.
• Apply server-side input validation through a reverse proxy to strip <script> tags and event handler attributes from panel_content.

# Example Content Security Policy header for nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';" always;