Land Down Under <= 800 Multiple Vulnerabilities

medium Nessus Plugin ID 19678

Synopsis

The remote web server contains a PHP script that permits SQL injection and cross-site scripting attacks.

Description

The remote version of Land Down Under is prone to various SQL injection and cross-site scripting attacks provided PHP's 'magic_quotes' setting is disabled due to its failure to sanitize the request URI before using it in 'system/functions.php' in the function 'ldu_log()'. A malicious user may be able to exploit this issue to manipulate SQL queries, steal authentication cookies, and the like.

In addition, it also fails to properly sanitize the user-supplied signature in forum posts. A malicious user can exploit this vulnerability to steal authentication cookies and manipulate the HTML format in 'forums.php'.

Solution

Upgrade to Land Down Under version 801 or later.

See Also

https://seclists.org/bugtraq/2005/Aug/275

https://seclists.org/bugtraq/2005/Aug/393

Plugin Details

Severity: Medium

ID: 19678

File Name: ldu_sql_injection.nasl

Version: 1.28

Type: remote

Family: CGI abuses

Published: 9/6/2005

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.3

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 6.5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:neocrome:land_down_under

Required KB Items: www/ldu

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 8/21/2005

Reference Information

CVE: CVE-2005-2674, CVE-2005-2675, CVE-2005-2780

BID: 14618, 14619, 14677

CWE: 20, 442, 629, 711, 712, 722, 725, 74, 750, 751, 79, 800, 801, 809, 811, 864, 900, 928, 931, 990