Detections
Analytics

CuteNews Debug Info Disclosure

medium Nessus Plugin ID 11940

Language:

Synopsis

The remote web server contains a PHP script that is prone to an information disclosure attack.

Description

There is a bug in the remote version of CuteNews that allows an attacker to obtain information from a call to the phpinfo() PHP function such as the username of the user who installed php, if they are a SUDO user, the IP address of the host, the web server version, the system version (unix / linux), and the root directory of the web server.

Solution

Disable CuteNews or upgrade to the newest version.

See Also

https://www.securityfocus.com/archive/1/346013

Plugin Details

Severity: Medium

ID: 11940

File Name: cutenews_phpinfo.nasl

Version: 1.18

Type: remote

Family: CGI abuses

Published: 12/4/2003

Updated: 1/19/2021

Supported Sensors: Nessus

Vulnerability Information

Required KB Items: www/cutenews

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Available: true

Exploit Ease: No exploit is required

Vulnerability Publication Date: 11/30/2003

Reference Information

BID: 9130