Detections
Analytics
PHP ip2long Function String Validation Weakness
medium Nessus Plugin ID 17715
Language:
Synopsis
The remote web server uses a version of PHP that does not properly validate user strings.Description
According to its banner, the 'ip2long()' function in the version of PHP installed on the remote host may incorrectly validate an arbitrary string and return a valid network IP address.Solution
Upgrade to PHP version 5.1.5 or later.See Also
http://www.nessus.org/u?3f88768a
https://www.securityfocus.com/archive/1/441529/100/100/threaded
Plugin Details
Severity: Medium
ID: 17715
File Name: php_ip2long_sql_injection.nasl
Version: 1.11
Type: remote
Family: CGI abuses
Published: 11/18/2011
Updated: 11/22/2024
Configuration: Enable thorough checks (optional)
Supported Sensors: Nessus
Enable CGI Scanning: true
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Medium
Base Score: 5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2006-4023
CVSS v3
Risk Factor: Medium
Base Score: 5.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Vulnerability Information
CPE: cpe:/a:php:php
Required KB Items: www/PHP, installed_sw/PHP, Settings/PCI_DSS
Patch Publication Date: 8/17/2006
Vulnerability Publication Date: 7/29/2006
Reference Information
CVE: CVE-2006-4023