This script is Copyright (C) 2011-2013 Tenable Network Security, Inc.
The remote web server uses a version of PHP that is affected by
According to its banner, the version of PHP 5.x installed on the
remote host is older than 5.1.0. Such versions may be affected by
multiple vulnerabilities :
- A cross-site scripting vulnerability exists in
- Multiple safe_mode/open_basedir bypass vulnerabilities
exist in ext/curl and ext/gd.
- It is possible to overwrite $GLOBALS due to an issue in
file upload handling, extract(), and
- An issue exists when a request is terminated due to
memory_limit constraints during certain parse_str()
calls, which could lead to register globals being turned
- An issue exists with trailing slashes in allowed
- An issue exists with calling virtual() on Apache 2, which
allows an attacker to bypass certain configuration
directives like safe_mode or open_basedir.
- A possible header injection exists in the mb_send_mail()
- The apache2handler SAPI in the Apache module allows
attackers to cause a denial of service.
See also :
Upgrade to PHP version 5.1.0 or later.
Risk factor :
Medium / CVSS Base Score : 5.0
CVSS Temporal Score : 4.3
Public Exploit Available : true