Wordtrans-web exec_wordtrans Function Arbitrary Command Execution

high Nessus Plugin ID 33391

Language:

Synopsis

The remote web server contains a PHP script that allows arbitrary command execution.

Description

The remote host is running wordtrans-web, a web-based front-end for wordtrans, for translating words.

The version of wordtrans-web installed on the remote host fails to sanitize input to the 'advanced' parameter of the 'wordtrans.php' script before using it in an 'passthru()' statement to execute PHP code. Provided PHP's 'magic_quotes_gpc' setting is disabled, an unauthenticated attacker can leverage this issue to execute arbitrary code on the remote host subject to the privileges of the web server user id.

Solution

Unknown at this time.

Plugin Details

Severity: High

ID: 33391

File Name: wordtrans_web_advanced_cmd_exec.nasl

Version: 1.21

Type: remote

Family: CGI abuses

Published: 7/2/2008

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 7.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 8.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:U/RC:X

Vulnerability Information

CPE: cpe:/a:wordtrans:wordtrans-web

Required KB Items: www/PHP

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Reference Information

BID: 30027

Detections

Analytics