HTTP response splitting vulnerability in index.php in phpSysInfo 2.4 and earlier, as used in phpgroupware 0.9.16 and earlier, and egroupware before 1.0.0.009, allows remote attackers to spoof web content and poison web caches via CRLF sequences in the charset parameter.

Several vulnerabilities have been discovered in egroupware, a web-based groupware suite. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-0870     Maksymilian Arciemowicz discovered several cross site     scripting problems in phpsysinfo, which are also present     in the imported version in egroupware and of which not     all were fixed in DSA 724.

  - CVE-2005-2600     Alexander Heidenreich discovered a cross-site scripting     problem in the tree view of FUD Forum Bulletin Board     Software, which is also present in egroupware and allows     remote attackers to read private posts via a modified     mid parameter.

  - CVE-2005-3347     Christopher Kunz discovered that local variables get     overwritten unconditionally in phpsysinfo, which are     also present in egroupware, and are trusted later, which     could lead to the inclusion of arbitrary files.

  - CVE-2005-3348     Christopher Kunz discovered that user-supplied input is     used unsanitised in phpsysinfo and imported in     egroupware, causing a HTTP Response splitting problem.

Several vulnerabilities have been discovered in phpsysinfo, a PHP based host information application that is included in phpgroupware.
The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-0870     Maksymilian Arciemowicz discovered several cross site     scripting problems, of which not all were fixed in DSA     724.

  - CVE-2005-3347     Christopher Kunz discovered that local variables get     overwritten unconditionally and are trusted later, which     could lead to the inclusion of arbitrary files.

  - CVE-2005-3348     Christopher Kunz discovered that user-supplied input is     used unsanitised, causing a HTTP Response splitting     problem.

Several vulnerabilities have been discovered in phpsysinfo, a PHP based host information application. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-0870     Maksymilian Arciemowicz discovered several cross site     scripting problems, of which not all were fixed in DSA     724.

  - CVE-2005-3347     Christopher Kunz discovered that local variables get     overwritten unconditionally and are trusted later, which     could lead to the inclusion of arbitrary files.

  - CVE-2005-3348     Christopher Kunz discovered that user-supplied input is     used unsanitised, causing a HTTP Response splitting     problem.

The remote host is affected by the vulnerability described in GLSA-200511-18 (phpSysInfo: Multiple vulnerabilities)

    Christopher Kunz from the Hardened-PHP Project discovered     that phpSysInfo is vulnerable to local file inclusion, cross-site     scripting and a HTTP Response Splitting attacks.
  Impact :

    A local attacker may exploit the file inclusion vulnerability by     sending malicious requests, causing the execution of arbitrary code     with the rights of the user running the web server. A remote attacker     could exploit the vulnerability to disclose local file content.
    Furthermore, the cross-site scripting issues gives a remote attacker     the ability to inject and execute malicious script code in the user's     browser context or to steal cookie-based authentication credentials.
    The HTTP response splitting issue give an attacker the ability to     perform site hijacking and cache poisoning.
  Workaround :

    There is no known workaround at this time.

The remote host is running phpSysInfo, a PHP application that parses the /proc entries on Linux/Unix systems and displays them in HTML.

The installed version of phpSysInfo on the remote host has a design flaw in its globalization layer such that the script's variables can be overwritten independent of PHP's 'register_globals' setting.  By exploiting this issue, an attacker may be able to read arbitrary files on the remote host and even execute arbitrary PHP code, both subject to the privileges of the web server user id.

In addition, the application fails to sanitize user-supplied input before using it in dynamically-generated pages, which can be used to conduct cross-site scripting and HTTP response splitting attacks.

The remote host is running PHPSysInfo, a PHP application that gives system information via a web interface.  This version of PHPSysInfo is vulnerable to a multitude of flaws.  These flaws include Cross-Site Scripting (XSS), HTML injection, and a local file inclusion flaw.  There is also an inherent risk whenever system information is displayed via a web interface.  Of these flaws, the more serious flaw is the local file inclusion vulnerability.  An attacker exploiting this flaw would be able to retrieve and display potentially confidential files (such as /etc/passwd).  This can lead to confidential materials being downloaded by anonymous users. 

The remote host is running phpSysInfo, a PHP script that monitors and reports on local *nix system resources utilization.  This version of phpSysInfo is vulnerable to a remote Cross-Site Scripting attack.  An attacker exploiting this flaw would need to be able to convince a user to browse a malicious URI.  Successful exploitation could lead to a loss of integrity as code would be executed by the browser within the security context of the vulnerable web site.

ID	Name	Product	Family	Severity
22765	Debian DSA-899-1 : egroupware - programming errors	Nessus	Debian Local Security Checks	medium
22764	Debian DSA-898-1 : phpgroupware - programming errors	Nessus	Debian Local Security Checks	medium
22763	Debian DSA-897-1 : phpsysinfo - programming errors	Nessus	Debian Local Security Checks	medium
20262	GLSA-200511-18 : phpSysInfo: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
20215	phpSysInfo < 2.4.1 Multiple Vulnerabilities	Nessus	CGI abuses	medium
3289	PHPSysInfo < 2.4.0 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
2748	phpSysInfo < 2.5 Multiple Script XSS	Nessus Network Monitor	CGI	low

Detections

Analytics

CVE-2005-3348

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

low