Mensajeitor Tag Board Admin Bypass

medium Nessus Plugin ID 13842

Language:

Synopsis

A web application running on the remote host has a security bypass vulnerability.

Description

The remote host is running Mensajeitor Tag Board.

According to its banner, the remote version of Mensajeitor has a security bypass vulnerability. Admin authentication can be bypassed by passing a value 'si' to the 'AdminNick' parameter.
A remote attacker could exploit this issue to post messages with administrative privileges.

Solution

Upgrade to Mensajeitor 1.8.9 r2 or later.

Plugin Details

Severity: Medium

ID: 13842

File Name: mensajeitor_admin_bypass.nasl

Version: 1.12

Type: remote

Family: CGI abuses

Published: 7/26/2004

Updated: 1/19/2021

Supported Sensors: Nessus

Vulnerability Information

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Available: true

Exploit Ease: No exploit is required

Reference Information

BID: 10774

Secunia: 12155

Detections

Analytics