Webfroot shoutbox.php conf Parameter Traversal Local File Inclusion

high Nessus Plugin ID 11668

Language:

Synopsis

The remote web server contains a PHP application that is affected by directory traversal and code injection vulnerabilities.

Description

The remote host is running Webfroot Shoutbox, a PHP application that allows website visitors to leave one another messages.

The version of Webfroot Shoutbox installed on the remote host allows an attacker to read arbitrary files and possibly to inject arbitrary PHP code into the remote host and gain a shell with the privileges of the web server.

Solution

Upgrade to the Shoutbox 2.33 or later.

See Also

https://seclists.org/vulnwatch/2003/q2/92

http://www.nessus.org/u?3e8aa30c

Plugin Details

Severity: High

ID: 11668

File Name: webfroot_shoutbox_file_injection.nasl

Version: 1.26

Type: remote

Family: CGI abuses

Published: 5/29/2003

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

Required KB Items: www/PHP

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Available: true

Exploit Ease: No exploit is required

Vulnerability Publication Date: 5/29/2003

Reference Information

BID: 7737, 7746, 7772, 7775