paFileDB 3.1, when using sessions authentication and while the administrator logs on, allows remote attackers to read the administrator's password hash and conduct brute force password guessing attacks by listing the contents of the sessions directory and reading the associated file for the administrator session.

The remote host is running a version of paFileDB that is prone to a wide variety of vulnerabilities, including arbitrary file uploads, local file inclusion, SQL injection, and cross-site scripting issues.

PHP Arena paFileDB is a web application that is used to manage files.  This version of paFileDB is vulnerable to a remote cross-site-scripting (XSS) flaw. Exploiting the flaw may enable an attacker to inject arbitrary script code into the browser of unsuspecting users.  A successful attack would potentially allow the attacker the ability to view confidential data (cookies, authentication data, and more) or compromise the integrity of the local system via the web browser.  The version of paFileDB is also vulnerable to a remote SQL injection attack.  An attacker exploiting this flaw would only need to be able to send a query to the 'viewall.php' or 'category.php' script.  A successful exploit would give the attacker the ability to read or write confidential data as well as potentially execute arbitrary commands on the remote web server.

The remote host is using PAFileDB.
According to its version number, the remote version of this software is vulnerable to path and password hash disclosure. This may allow an attacker to perform brute force attack on the password hash and gain access to account information.

According to its version number, the remote installation of paFileDB is vulnerable to an attack that would allow the attacker to view the password hash of user accounts, including an administrator account, by making a direct request to the application's 'sessions' directory. This could allow an attacker to perform brute-force attacks on the password hash and gain access to account information.

The vulnerability exists only when session-based authentication is performed, which is not the default.

ID	Name	Product	Family	Type	Severity
17329	paFileDB <= 3.1 Multiple Vulnerabilities (2)	Nessus	CGI abuses	Remote	medium
2686	paFileDB < 3.2 XSS and SQL Injection Vulnerabilities	Nessus Network Monitor	CGI		medium
2445	PAFileDB Multiple Information Disclosure Vulnerabilities	Nessus Network Monitor	CGI		medium
15911	paFileDB sessions Directory Admin Hashed Password Disclosure	Nessus	CGI abuses	Remote	medium
11806	paFileDB <= 3.1 Multiple Vulnerabilities (1)	Nessus	CGI abuses	Remote	high

Detections

Analytics

CVE-2004-1219

critical

Tenable Plugins

medium

medium

medium

medium

high