Detections
Analytics
SPIP < 1.8.2-g Multiple Vulnerabilities
high Nessus Plugin ID 20978
Language:
Synopsis
The remote web server has a PHP application that is affected by multiple flaws.Description
The remote host is running SPIP, an open source CMS written in PHP.The remote version of this software is prone to SQL injection and cross-site scripting attacks. An attacker could send specially crafted URL to modify SQL requests, for example, to obtain the admin password hash, or execute malicious script code on the remote system.
Solution
Upgrade to SPIP version 1.8.2-g or later.See Also
https://www.securityfocus.com/archive/1/423655/30/0/threaded
Plugin Details
Severity: High
ID: 20978
File Name: spip_sql_injection.nasl
Version: 1.27
Type: remote
Family: CGI abuses
Published: 2/25/2006
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.1
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:spip:spip
Required KB Items: www/PHP
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No exploit is required
Vulnerability Publication Date: 1/31/2006