Detections
Analytics
Justice Guestbook 1.3 Multiple Vulnerabilities
medium Nessus Plugin ID 11501
Language:
Synopsis
The remote web server is hosting a PHP script that is affected by multiple vulnerabilities.Description
The remote host is running Justice Guestbook.This set of CGI has two vulnerabilities :
- It is vulnerable to cross-site scripting attacks (in jgb.php3).
- If the user requests the file cfooter.php3, he will obtain the physical path of the remote CGI.
An attacker may use these flaws to steal the cookies of your users or to gain better knowledge about this host.
Solution
There is no known solution at this time.See Also
Plugin Details
Severity: Medium
ID: 11501
File Name: guestbook_justice.nasl
Version: 1.22
Type: remote
Family: CGI abuses
Published: 3/30/2003
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.8
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 5
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N
Vulnerability Information
Required KB Items: www/PHP
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: No exploit is required
Reference Information
CVE: CVE-2003-1534, CVE-2003-1535