|
Family: CGI abuses --> Category: attack
BASE BASE_path Parameter Remote File Include Vulnerability Vulnerability Scan
Vulnerability Scan Summary Tries to read a local file using BASE
Detailed Explanation for this Vulnerability Test
Synopsis :
The remote web server contains a PHP application that is prone to
remote file inclusion attacks.
Description :
The remote host is running BASE, a web-based tool for analyzing alerts
from one or more SNORT sensors.
The version of BASE installed on the remote host fails to sanitize
input to the 'BASE_path' parameter before using it in PHP
include_once() function in several scripts. Provided PHP's
'register_globals' setting is enabled, an unauthenticated attacker may
be able to exploit this flaw to view arbitrary files on the remote
host or to execute arbitrary PHP code, possibly taken from third-party
hosts.
See also :
http://milw0rm.com/exploits/1823
http://www.nessus.org/u?dd74f480
Solution :
Upgrade to BASE 1.2.5 or later.
Threat Level:
Low / CVSS Base Score : 3.7
(AV:R/AC:H/Au:NR/C:P/I:P/A:N/B:N)
Click HERE for more information and discussions on this network vulnerability scan.
|