COMMAND

	Fuse Talk

SYSTEMS AFFECTED

	Fuse Talk

PROBLEM

	Anthony Cole found following, about e-zonemedia\'s Fuse Talk,  which  is
	vulnerable  to  malicious  SQL.  Improper  form  sanitization  makes  it
	possible for any user to manipulate data as  (s)he  feels  fit.  On  the
	sign up form  (join.cfm)  is  possible  to  pass  a  well  crafted  form
	variable to the action template (it\'s the  same  template  subsequently
	join.cfm) that will execute malicious SQL. This is made possible by  not
	filtering the (;) semi-colon. Examine the following code:
	

	

	     1;delete from users

	

	

	or
	

	

	     1;exec sp_addlogin \"OsamaBinLadenSucks\"

	

	

SOLUTION

	Nothing yet.