|
Family: CGI abuses --> Category: attack
phpwcms spaw_root Parameter Remote File Include Vulnerability Vulnerability Scan
Vulnerability Scan Summary Tries to read a local file using phpwcms
Detailed Explanation for this Vulnerability Test
Synopsis :
The remote web server contains a PHP application that is susceptible
to remote file inclusion attacks.
Description :
The remote host is running phpwcms, an open-source content management
system written in PHP.
The version of phpwcms installed on the remote host fails to sanitize
user-supplied input to the 'spaw_root' parameter before using it in
PHP include() functions in the
'include/inc_ext/spaw/spaw_control.class.php' script. Provided PHP's
'register_globals' setting is enabled, an unauthenticated attacker may
be able to exploit this flaw to view arbitrary files on the remote
host or to execute arbitrary PHP code, possibly taken from third-party
hosts.
See also :
http://www.securityfocus.com/archive/1/434706/30/0/threaded
Solution :
Unknown at this time.
Threat Level:
Low / CVSS Base Score : 1.9
(AV:R/AC:H/Au:NR/C:N/I:P/A:N/B:N)
Click HERE for more information and discussions on this network vulnerability scan.
|