Multiple cross-site scripting (XSS) vulnerabilities in phpSysInfo 2.3, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) sensor_program parameter to index.php, (2) text[language], (3) text[template], or (4) hide_picklist parameter to system_footer.php.

Several vulnerabilities have been discovered in egroupware, a web-based groupware suite. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-0870     Maksymilian Arciemowicz discovered several cross site     scripting problems in phpsysinfo, which are also present     in the imported version in egroupware and of which not     all were fixed in DSA 724.

  - CVE-2005-2600     Alexander Heidenreich discovered a cross-site scripting     problem in the tree view of FUD Forum Bulletin Board     Software, which is also present in egroupware and allows     remote attackers to read private posts via a modified     mid parameter.

  - CVE-2005-3347     Christopher Kunz discovered that local variables get     overwritten unconditionally in phpsysinfo, which are     also present in egroupware, and are trusted later, which     could lead to the inclusion of arbitrary files.

  - CVE-2005-3348     Christopher Kunz discovered that user-supplied input is     used unsanitised in phpsysinfo and imported in     egroupware, causing a HTTP Response splitting problem.

Several vulnerabilities have been discovered in phpsysinfo, a PHP based host information application that is included in phpgroupware.
The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-0870     Maksymilian Arciemowicz discovered several cross site     scripting problems, of which not all were fixed in DSA     724.

  - CVE-2005-3347     Christopher Kunz discovered that local variables get     overwritten unconditionally and are trusted later, which     could lead to the inclusion of arbitrary files.

  - CVE-2005-3348     Christopher Kunz discovered that user-supplied input is     used unsanitised, causing a HTTP Response splitting     problem.

Several vulnerabilities have been discovered in phpsysinfo, a PHP based host information application. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-0870     Maksymilian Arciemowicz discovered several cross site     scripting problems, of which not all were fixed in DSA     724.

  - CVE-2005-3347     Christopher Kunz discovered that local variables get     overwritten unconditionally and are trusted later, which     could lead to the inclusion of arbitrary files.

  - CVE-2005-3348     Christopher Kunz discovered that user-supplied input is     used unsanitised, causing a HTTP Response splitting     problem.

A Securityreason.com advisory reports that various cross site scripting vulnerabilities have been found in phpSysInfo. Input is not properly sanitised before it is returned to the user. A malicious person could exploit this to execute arbitrary HTML and script code in a users browser session. Also it is possible to view the full path of certain scripts by accessing them directly.

The remote host is running phpSysInfo, a PHP application that parses the /proc entries on Linux/Unix systems and displays them in HTML.

The installed version of phpSysInfo on the remote host has a design flaw in its globalization layer such that the script's variables can be overwritten independent of PHP's 'register_globals' setting.  By exploiting this issue, an attacker may be able to read arbitrary files on the remote host and even execute arbitrary PHP code, both subject to the privileges of the web server user id.

In addition, the application fails to sanitize user-supplied input before using it in dynamically-generated pages, which can be used to conduct cross-site scripting and HTTP response splitting attacks.

The remote host is running PHPSysInfo, a PHP application that gives system information via a web interface.  This version of PHPSysInfo is vulnerable to a multitude of flaws.  These flaws include Cross-Site Scripting (XSS), HTML injection, and a local file inclusion flaw.  There is also an inherent risk whenever system information is displayed via a web interface.  Of these flaws, the more serious flaw is the local file inclusion vulnerability.  An attacker exploiting this flaw would be able to retrieve and display potentially confidential files (such as /etc/passwd).  This can lead to confidential materials being downloaded by anonymous users. 

Maksymilian Arciemowicz discovered several cross site scripting issues in phpsysinfo, a PHP based host information application.

The remote host is running phpSysInfo, a PHP script that parses the /proc entries on Linux systems and displays them in HTML. 

The version of phpSysInfo installed on the remote host is affected by multiple cross-site scripting vulnerabilities due to its failure to sanitize user input to the 'sensor_program' parameter of 'index.php' and the 'text[language]', 'text[template]', and 'VERSION' parameters of 'system_footer.php'.  If PHP's 'register_globals' setting is enabled, a remote attacker can exploit these flaws to have arbitrary script rendered in the browser of a user in the context of the affected website.

The remote host is running phpSysInfo, a PHP script that monitors and reports on local *nix system resources utilization.  This version of phpSysInfo is vulnerable to a remote Cross-Site Scripting attack.  An attacker exploiting this flaw would need to be able to convince a user to browse a malicious URI.  Successful exploitation could lead to a loss of integrity as code would be executed by the browser within the security context of the vulnerable web site.

ID	Name	Product	Family	Severity
22765	Debian DSA-899-1 : egroupware - programming errors	Nessus	Debian Local Security Checks	medium
22764	Debian DSA-898-1 : phpgroupware - programming errors	Nessus	Debian Local Security Checks	medium
22763	Debian DSA-897-1 : phpsysinfo - programming errors	Nessus	Debian Local Security Checks	medium
21428	FreeBSD : phpSysInfo -- XSS vulnerability (50457509-d05e-11d9-9aed-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	medium
20215	phpSysInfo < 2.4.1 Multiple Vulnerabilities	Nessus	CGI abuses	medium
3289	PHPSysInfo < 2.4.0 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
18303	Debian DSA-724-1 : phpsysinfo - design flaw	Nessus	Debian Local Security Checks	medium
17610	PHPSysInfo < 2.5 Multiple Script XSS	Nessus	CGI abuses : XSS	medium
2748	phpSysInfo < 2.5 Multiple Script XSS	Nessus Network Monitor	CGI	low

Detections

Analytics

CVE-2005-0870

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

low