ZeroBoard Multiple Scripts dir Parameter Remote File Inclusion

high Nessus Plugin ID 16178

Language:

Synopsis

The remote web server contains several PHP scripts that are prone to arbitrary PHP code execution and file disclosure attacks.

Description

The remote host runs Zeroboard, a web BBS application popular in Korea.

The remote version of this CGI is vulnerable to multiple flaws which may allow an attacker to execute arbitrary PHP commands on the remote host by including a PHP file hosted on a third-party server, or to read arbitrary files with the privileges of the remote web server.

Solution

Upgrade to Zeroboard 4.1pl6 or later.

Plugin Details

Severity: High

ID: 16178

File Name: zeroboard_flaws2.nasl

Version: 1.20

Type: remote

Family: CGI abuses

Published: 1/17/2005

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

Required KB Items: www/PHP

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Ease: No exploit is required

Vulnerability Publication Date: 1/13/2005

Reference Information

CVE: CVE-2005-0380

BID: 12258

Detections

Analytics