Vulnerability Scanning Solutions, LLC.
Home
Our Process
Residential
Corporate
What We Scan For
Sample Report
Client List
Terms
Contact Us
What We Scan For
Family: CGI abuses --> Category: attack

BASE BASE_path Parameter Remote File Include Vulnerability Vulnerability Scan


Vulnerability Scan Summary
Tries to read a local file using BASE

Detailed Explanation for this Vulnerability Test

Synopsis :

The remote web server contains a PHP application that is prone to
remote file inclusion attacks.

Description :

The remote host is running BASE, a web-based tool for analyzing alerts
from one or more SNORT sensors.

The version of BASE installed on the remote host fails to sanitize
input to the 'BASE_path' parameter before using it in PHP
include_once() function in several scripts. Provided PHP's
'register_globals' setting is enabled, an unauthenticated attacker may
be able to exploit this flaw to view arbitrary files on the remote
host or to execute arbitrary PHP code, possibly taken from third-party
hosts.

See also :

http://milw0rm.com/exploits/1823
http://www.nessus.org/u?dd74f480

Solution :

Upgrade to BASE 1.2.5 or later.

Threat Level:

Low / CVSS Base Score : 3.7
(AV:R/AC:H/Au:NR/C:P/I:P/A:N/B:N)

Click HERE for more information and discussions on this network vulnerability scan.

VSS, LLC.

P.O. Box 827051

Pembroke Pines, FL 33082-7051

Vulnerability Scanning Solutions, LLC.