Detections
Analytics
phpWebSite <= 0.10.1 Multiple Vulnerabilities
high Nessus Plugin ID 18636
Language:
Synopsis
The remote web server contains a PHP script that is prone to SQL injection and directory traversal attacks.Description
The remote host is running a version of phpWebSite that suffers from multiple flaws :- Multiple SQL Injection Vulnerabilities An attacker can affect database queries through the parameters 'module' and 'mod' of the script 'index.php'.
This may allow for disclosure of sensitive information, attacks against the underlying database, and the like.
- A Directory Traversal Vulnerability An attacker can read arbitrary files on the remote host by using instances of the substring '../' in the 'mod' parameter of the script 'index.php'.
Solution
Apply the security patch referenced in the vendor's advisory.See Also
Plugin Details
Severity: High
ID: 18636
File Name: phpwebsite_0101.nasl
Version: 1.20
Type: remote
Family: CGI abuses
Published: 7/7/2005
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:phpwebsite:phpwebsite
Required KB Items: www/phpwebsite
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: No exploit is required
Vulnerability Publication Date: 7/7/2005