Detections
Analytics
Land Down Under < 802 events.php SQL Injection
medium Nessus Network Monitor Plugin ID 3209
Synopsis
The remote web server contains a script that is vulnerable to a SQL injection attack.Description
The remote host is running Land Down Under, a web-based content management system. This version of LDU is vulnerable to a script injection flaw within the 'events.php' script. An attacker exploiting this flaw would need to be able to convince a user to browse to a malicious URI. Successful exploitation would lead to script code being executed within the user's browser. In addition, the product is vulnerable to multiple SQL injection flaws. An attacker exploiting these flaws would be able to execute code within the context of the database.Solution
Upgrade to version 802 or higher.See Also
http://www.packetstormsecurity.org/0509-advisories/LDU801.txt
http://securityfocus.com/archive/1/409511
http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0381.html
Plugin Details
Severity: Medium
ID: 3209
Family: CGI
Published: 9/7/2005
Updated: 3/6/2019
Nessus ID: 19603
Risk Information
VPR
Risk Factor: Medium
Score: 6.6
CVSS v2
Risk Factor: Medium
Base Score: 5.8
Temporal Score: 5.5
Vector: CVSS2#AV:A/AC:L/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: Medium
Base Score: 6.3
Temporal Score: 6.2
Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:F/RL:U/RC:X
Vulnerability Information
CPE: cpe:/a:neocrome:land_down_under
Reference Information
CVE: CVE-2005-2674, CVE-2005-2675, CVE-2005-2780, CVE-2005-2788, CVE-2005-2884, CVE-2005-4821, CVE-2006-6343, CVE-2006-6577