Detections
Analytics
RaidenHTTPD workspace.php ulang Parameter Local File Inclusion
high Nessus Plugin ID 29728
Language:
Synopsis
The remote web server contains a PHP script that is susceptible to a local file include attack.Description
The remote host is running RaidenHTTPD, a web server for Windows.The version of RaidenHTTPD installed on the remote host fails to sanitize user-supplied input to the 'ulang' parameter in scripts '/raidenhttpd-admin/workspace.php' and '/raidenhttpd-admin/menu.php' before using it to include PHP code. Provided the server's WebAdmin feature has been enabled, an unauthenticated, remote attacker can leverage this issue to view arbitrary files or to execute arbitrary PHP code on the remote host, subject to the privileges under which the server operates, which is SYSTEM by default.
Solution
Upgrade to RaidenHTTPD Server 2.0.27 or later.See Also
http://www.nessus.org/u?4c77cd3d
https://www.securityfocus.com/archive/1/485221/30/0/threaded
Plugin Details
Severity: High
ID: 29728
File Name: raidenhttpd_ulang_file_include.nasl
Version: 1.19
Type: remote
Family: CGI abuses
Published: 12/19/2007
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 7.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/a:raiden_professional_servers:raidenhttpd
Exploit Ease: No exploit is required
Exploited by Nessus: true
Reference Information
CVE: CVE-2007-6453