|
Family: CGI abuses --> Category: attack
Advanced Guestbook phpbb_root_path Parameter Remote File Include Vulnerability Vulnerability Scan
Vulnerability Scan Summary Tries to read /etc/passwd using Advanced Guestbook
Detailed Explanation for this Vulnerability Test
Synopsis :
The remote web server contains a PHP script that is affected by a
remote file include issue.
Description :
The remote host is running Advanced Guestbook, a free guestbook
written in PHP.
The version of Advanced Guestbook installed on the remote host fails
to sanitize input to the 'phpbb_root_path' parameter of the
'admin/addentry.php' script before using it in a PHP 'include()'
function. Provided PHP's 'register_globals' setting is enabled, an
unauthenticated attacker may be able to exploit this issue to view
arbitrary files on the remote host or to execute arbitrary PHP code,
possibly taken from third-party hosts.
See also :
http://milw0rm.com/exploits/1723
Solution :
Upgrade to Advanced Guestbook version 2.4.1 or later.
Threat Level:
High / CVSS Base Score : 7.0
(AV:R/AC:L/Au:NR/C:P/I:P/A:P/B:N)
Click HERE for more information and discussions on this network vulnerability scan.
|