Detections
Analytics
zenTrack index.php configFile Parameter Traversal Arbitrary Files Access
medium Nessus Plugin ID 11708
Language:
Synopsis
The remote web server contains a PHP script that is prone to file disclosure attacks.Description
It is possible to make the remote web server show the content of arbitrary files by making requests like :index.php?configFile=../../../../../../../../../../etc/passwd
Solution
Upgrade to zenTrack 2.4.2 or later.See Also
https://www.securityfocus.com/archive/1/324264/2003-06-04/2003-06-10/0
Plugin Details
Severity: Medium
ID: 11708
File Name: zentrack_read_files.nasl
Version: 1.25
Type: remote
Family: CGI abuses
Published: 6/9/2003
Updated: 1/19/2021
Supported Sensors: Nessus
Vulnerability Information
Required KB Items: www/PHP
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: No exploit is required
Vulnerability Publication Date: 6/6/2003
Reference Information
BID: 7843