pafiledb.php in PaFileDB 3.1 allows remote attackers to gain sensitive information via an invalid or missing action parameter, which reveals the path in an error message when it cannot include a login.php script.

The remote host is running a version of paFileDB that is prone to a wide variety of vulnerabilities, including arbitrary file uploads, local file inclusion, SQL injection, and cross-site scripting issues.

PHP Arena paFileDB is a web application that is used to manage files.  This version of paFileDB is vulnerable to a remote cross-site-scripting (XSS) flaw. Exploiting the flaw may enable an attacker to inject arbitrary script code into the browser of unsuspecting users.  A successful attack would potentially allow the attacker the ability to view confidential data (cookies, authentication data, and more) or compromise the integrity of the local system via the web browser.  The version of paFileDB is also vulnerable to a remote SQL injection attack.  An attacker exploiting this flaw would only need to be able to send a query to the 'viewall.php' or 'category.php' script.  A successful exploit would give the attacker the ability to read or write confidential data as well as potentially execute arbitrary commands on the remote web server.

ID	Name	Product	Family	Severity
17329	paFileDB <= 3.1 Multiple Vulnerabilities (2)	Nessus	CGI abuses	medium
2686	paFileDB < 3.2 XSS and SQL Injection Vulnerabilities	Nessus Network Monitor	CGI	medium
11806	paFileDB <= 3.1 Multiple Vulnerabilities (1)	Nessus	CGI abuses	high

Detections

Analytics

CVE-2005-0326

medium

Tenable Plugins

medium

medium

high