Detections
Analytics

FreeBSD : phpmyfaq -- cross-site request forgery vulnerability (f87a9376-0943-11e6-8fc4-00a0986f28c4)

high Nessus Plugin ID 90699

Language:

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

The phpMyFAQ team reports :

The vulnerability exists due to application does not properly verify origin of HTTP requests in 'Interface Translation' functionality.: A remote unauthenticated attacker can create a specially crafted malicious web page with CSRF exploit, trick a logged-in administrator to visit the page, spoof the HTTP request, as if it was coming from the legitimate user, inject and execute arbitrary PHP code on the target system with privileges of the webserver.

Solution

Update the affected package.

See Also

https://www.htbridge.com/advisory/HTB23300

https://www.phpmyfaq.de/security/advisory-2016-04-11

http://www.nessus.org/u?9123b4c8

Plugin Details

Severity: High

ID: 90699

File Name: freebsd_pkg_f87a9376094311e68fc400a0986f28c4.nasl

Version: 2.4

Type: Local

Published: 4/25/2016

Updated: 1/4/2021

Supported Sensors: Nessus

Vulnerability Information

CPE: cpe:/o:freebsd:freebsd, p-cpe:/a:freebsd:freebsd:phpmyfaq

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 4/23/2016

Vulnerability Publication Date: 4/11/2016