EGroupWare Multiple Vulnerabilities (SQLi, ID)
high Nessus Plugin ID 15719
Language:
Synopsis
The remote web server contains a PHP application that is vulnerable to multiple attacks.Description
The remote host is running eGroupWare, a web-based groupware solution.It is reported that versions 1.0.0.006 and older are prone to multiple SQL injection and cross-site scripting flaws.
Solution
Upgrade to eGroupWare 1.0.0.007 or later.See Also
http://www.gulftech.org/?node=research&article_id=00069-04202005
http://sourceforge.net/project/shownotes.php?release_id=320768
Plugin Details
Severity: High
ID: 15719
File Name: egroupware_unknown_vuln.nasl
Version: 1.22
Type: remote
Family: CGI abuses
Published: 11/13/2004
Updated: 1/19/2021
Risk Information
VPR
Risk Factor: Medium
Score: 6.6
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Temporal Vector: E:U/RL:OF/RC:C
Vulnerability Information
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: No exploit is required
Vulnerability Publication Date: 4/12/2005