Family: CGI abuses --> Category: attack
Advanced Guestbook phpbb_root_path Parameter Remote File Include Vulnerability Vulnerability Scan
Vulnerability Scan Summary
Tries to read /etc/passwd using Advanced Guestbook
Detailed Explanation for this Vulnerability Test
The remote web server contains a PHP script that is affected by a
remote file include issue.
The remote host is running Advanced Guestbook, a free guestbook
written in PHP.
The version of Advanced Guestbook installed on the remote host fails
to sanitize input to the 'phpbb_root_path' parameter of the
'admin/addentry.php' script before using it in a PHP 'include()'
function. Provided PHP's 'register_globals' setting is enabled, an
unauthenticated attacker may be able to exploit this issue to view
arbitrary files on the remote host or to execute arbitrary PHP code,
possibly taken from third-party hosts.
See also :
Upgrade to Advanced Guestbook version 2.4.1 or later.
High / CVSS Base Score : 7.0
Click HERE for more information and discussions on this network vulnerability scan.