paFileDB < 3.2 XSS and SQL Injection Vulnerabilities

Medium Nessus Network Monitor Plugin ID 2686


The remote web server contains a script that is vulnerable to a SQL injection attack.


PHP Arena paFileDB is a web application that is used to manage files. This version of paFileDB is vulnerable to a remote cross-site-scripting (XSS) flaw. Exploiting the flaw may enable an attacker to inject arbitrary script code into the browser of unsuspecting users. A successful attack would potentially allow the attacker the ability to view confidential data (cookies, authentication data, and more) or compromise the integrity of the local system via the web browser. The version of paFileDB is also vulnerable to a remote SQL injection attack. An attacker exploiting this flaw would only need to be able to send a query to the 'viewall.php' or 'category.php' script. A successful exploit would give the attacker the ability to read or write confidential data as well as potentially execute arbitrary commands on the remote web server.


Upgrade to version 3.2 or higher.

See Also

Plugin Details

Severity: Medium

ID: 2686

Family: CGI

Published: 2005/03/09

Modified: 2016/01/21

Dependencies: 1442

Nessus ID: 11806, 19505

Risk Information

Risk Factor: Medium


Base Score: 5.8

Temporal Score: 5.2

Vector: CVSS2#AV:A/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:F/RL:W/RC:ND


Base Score: 6.3

Temporal Score: 6


Temporal Vector: CVSS3#E:F/RL:W/RC:X

Reference Information

CVE: CVE-2005-2723, CVE-2006-2361, CVE-2004-1219, CVE-2004-1551, CVE-2004-1975, CVE-2005-0326, CVE-2005-0327, CVE-2005-0723, CVE-2005-0724, CVE-2005-0781, CVE-2005-0782

BID: 10229, 11817, 11818, 7183, 8271, 12788, 17930, 14654, 12952, 13967, 12758