Detections
Analytics
phpWebThings Multiple Scripts SQL Injection
high Nessus Plugin ID 20170
Language:
Synopsis
The remote web server contains a PHP script that is prone to SQL injection attacks.Description
The remote host is running the phpWebThings application framework.The version of phpWebThings installed on the remote host does not properly sanitize user input in the 'forum' and 'msg' parameters of 'forum.php' script before using it in database queries. An attacker can exploit this vulnerability to display the usernames and passwords (md5 hash) from the website and then use this information to gain administrative access to the affected application.
Solution
Apply the phpWebthings 1.4 forum patch referenced in the third URL above.See Also
https://seclists.org/bugtraq/2005/Nov/56
Plugin Details
Severity: High
ID: 20170
File Name: phpwebthings_sql_injection.nasl
Version: 1.28
Type: remote
Family: CGI abuses
Published: 11/8/2005
Updated: 4/7/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.1
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:phpwebthings:phpwebthings
Required KB Items: www/PHP
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No exploit is required
Patch Publication Date: 11/7/2005
Vulnerability Publication Date: 11/3/2005
Reference Information
CVE: CVE-2005-3585, CVE-2005-4218