Detections
Analytics
phpSysInfo < 2.5 Multiple Script XSS
low Nessus Network Monitor Plugin ID 2748
Synopsis
The remote host is vulnerable to a Cross-Site Scripting (XSS) attack.Description
The remote host is running phpSysInfo, a PHP script that monitors and reports on local *nix system resources utilization. This version of phpSysInfo is vulnerable to a remote Cross-Site Scripting attack. An attacker exploiting this flaw would need to be able to convince a user to browse a malicious URI. Successful exploitation could lead to a loss of integrity as code would be executed by the browser within the security context of the vulnerable web site.Solution
Upgrade to version 2.5 or higher.See Also
http://www.securityfocus.com/archive/1/394086
http://sourceforge.net/project/shownotes.php?release_id=376350&group_id=15
Plugin Details
Severity: Low
ID: 2748
Family: CGI
Published: 3/23/2005
Updated: 3/6/2019
Nessus ID: 17610
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS v3
Risk Factor: Low
Base Score: 3.7
Temporal Score: 3.6
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Temporal Vector: CVSS:3.0/E:H/RL:O/RC:X
Vulnerability Information
CPE: cpe:/a:phpsysinfo:phpsysinfo