|
|
Family: CGI abuses --> Category: attack
JCE Admin Component Local File Include Vulnerability Vulnerability Scan
Vulnerability Scan Summary
Tries to read a local file with JCE Admin Component
Detailed Explanation for this Vulnerability Test
Synopsis :
The remote web server contains a PHP script that is affected by a
local file include issue.
Description :
The installation of Joomla on the remote host includes a third-party
component, the JCE Admin component, that fails to sanitize input to
the 'test' and 'file' parameters before using it in the
'components/com_jce/jce.php' script to include PHP code. Regardless
of PHP's 'register_globals' setting, an unauthenticated attacker may
be able to leverage this issue to view arbitrary files or to execute
arbitrary PHP code on the remote host, subject to the rights of
the web server user id.
In addition, the component is also reportedly affected by multiple
cross-site scripting vulnerabilities involving other parameters to the
same script.
Solution :
Unknown at this time.
Threat Level:
High / CVSS Base Score : 7.0
(AV:R/AC:L/Au:NR/C:P/I:P/A:P/B:N)
Click HERE for more information and discussions on this network vulnerability scan.
|
