|
|
Family: CGI abuses --> Category: attack
Mambo Open Source / Joomla! GLOBALS Variable Remote File Include Vulnerability Vulnerability Scan
Vulnerability Scan Summary
Tries to read a file using Mambo Open Source / Joomla!
Detailed Explanation for this Vulnerability Test
Synopsis :
The remote web server contains a PHP application that is affected by a
remote file include issue.
Description :
The remote installation of Mambo Open Source or Joomla! allows an
attacker to overwrite the GLOBALS variable array when PHP's
'register_globals' setting is disabled. An unauthenticated attacker
may be able to exploit this issue to view arbitrary files on the
remote host and to execute arbitrary PHP code, possibly taken from
third-party hosts.
See also :
http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0520.html
http://forum.mamboserver.com/showthread.php?t=66154
http://www.joomla.org/content/view/498/74/
Solution :
If using Mambo Open Source, apply the patch from the vendor. If using
Joomla!, upgrade to version 1.0.4 or later.
Threat Level:
Low / CVSS Base Score : 1.9
(AV:R/AC:H/Au:NR/C:N/I:P/A:N/B:N)
Click HERE for more information and discussions on this network vulnerability scan.
|
