|
|
Family: CGI abuses --> Category: attack
Looking Glass Multiple Vulnerabilities Vulnerability Scan
Vulnerability Scan Summary
Checks for multiple vulnerabilities in Looking Glass
Detailed Explanation for this Vulnerability Test
Synopsis :
The remote web server contains a PHP application that is affected by
multiple issues.
Description :
The remote host appears to be running Jurriaan de Neef's Looking Glass
script, which provides a web interface to various network utilities
such as ping, traceroute, and whois.
The installed version of Looking Glass suffers from a flaw that allows
a possible hacker, by manipulating input to the 'target' parameter of the
'lp.php' script, to execute commands on the remote host subject to the
permissions of the web server user id. In addition, it also is prone
to cross-site scripting attacks due to its failure to sanitize
user-supplied input to the 'version' parameter of the 'header.php' and
'footer.php' scripts.
See also :
http://retrogod.altervista.org/lookingglass.html
http://archives.neohapsis.com/archives/bugtraq/2005-08/0381.html
Solution :
Unknown at this time.
Threat Level:
High / CVSS Base Score : 7
(AV:R/AC:L/Au:NR/C:P/A:P/I:P/B:N)
Click HERE for more information and discussions on this network vulnerability scan.
|
