Detections
Analytics
phpSlash fields Parameter PHP Code Injection
high Nessus Plugin ID 35587
Language:
Synopsis
The remote web server contains a PHP application that allows execution of arbitrary PHP code.Description
The remote host is running phpSlash, a PHP weblog and content management system that started out as a port of the Perl code used to power Slashdot.org.The installed version of phpSlash fails to validate user-supplied input to the 'fields' parameter of the 'index.php' script before using it to call 'eval()' in the 'tz_env::generic'' method. Regardless of PHP's 'register_globals' and 'magic_quotes_gpc' settings, an unauthenticated attacker can exploit this issue to inject arbitrary PHP code and execute it on the remote host, subject to the privileges of the web server user id.
Solution
Unknown at this time.Plugin Details
Severity: High
ID: 35587
File Name: phpslash_fields_code_injection.nasl
Version: 1.22
Type: remote
Family: CGI abuses
Published: 2/4/2009
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.4
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.2
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 8.2
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:phpslash:phpslash
Required KB Items: www/PHP
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No exploit is required
Exploited by Nessus: true
Exploitable With
CANVAS (CANVAS)
Reference Information
CVE: CVE-2009-0517
BID: 33572