Detections
Analytics
Stadtaus Form Mail < 2.4 formmail.inc.php Remote File Inclusion
medium Nessus Network Monitor Plugin ID 2673
Synopsis
The remote host is vulnerable to an arbitrary 'command insertion' flaw.Description
The remote host is running the Stadtaus PHP Form Mail script. This script is used to send form information to an email address. This version of Form Mail is vulnerable to a flaw where incorrect parsing of the script_root parameter of the formmail.inc.php script can lead to arbitrary code being sent to the 'include()' function call. A successful attack would give the attacker the ability to execute arbitrary code on the target server.Solution
Upgrade to Form Mail 2.4 or higher.See Also
http://archives.neohapsis.com/archives/bugtraq/2005-03/0083.html
Plugin Details
Severity: Medium
ID: 2673
Family: CGI
Published: 3/7/2005
Updated: 3/6/2019
Nessus ID: 17285
Risk Information
VPR
Risk Factor: Medium
Score: 6.3
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 6.5
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: Medium
Base Score: 5.6
Temporal Score: 5.5
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:H/RL:W/RC:X
Vulnerability Information
CPE: cpe:/a:stadtaus:form_mail_script
Reference Information
CVE: CVE-2005-0678
BID: 12735