Detections
Analytics
ezUpload <= 2.2 Multiple Remote Vulnerabilities (SQLi, RFI, LFI)
high Nessus Plugin ID 19418
Language:
Synopsis
The remote web server contains a PHP application that is affected by multiple flaws.Description
The remote host appears to be running ezUpload, a commercial upload script written in PHP.The installed version of ezUpload allows remote attackers to control the 'path' and 'mode' parameters used when including PHP code in several scripts. By leveraging this flaw, an attacker may be able to view arbitrary files on the remote host and execute arbitrary PHP code, possibly taken from third-party hosts. Successful exploitation may depend on PHP's 'magic_quotes_gpc' and 'allow_url_fopen' settings.
In addition, it reportedly fails to sanitize input passed to various parameters in the search module before using it in database queries, which opens the application up to SQL injection as well as cross-site scripting attacks.
Solution
Unknown at this time.See Also
Plugin Details
Severity: High
ID: 19418
File Name: ezupload_path_file_includes.nasl
Version: 1.25
Type: remote
Family: CGI abuses
Published: 8/10/2005
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.6
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 7.1
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
Required KB Items: www/PHP
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: No exploit is required
Vulnerability Publication Date: 8/11/2005