phpMyFAQ index.php action Parameter Local File Inclusion

medium Nessus Plugin ID 14258

Language:

Synopsis

The remote web server contains a PHP script that permits information disclosure of local files.

Description

The version of phpMyFAQ on the remote host contains a flaw that may lead to an unauthorized information disclosure. The problem is that user input passed to the 'action' parameter is not properly verified before being used to include files, which could allow a remote attacker to view any accessible file on the system, resulting in a loss of confidentiality.

Solution

Upgrade to phpMyFAQ 1.3.13 or newer.

Plugin Details

Severity: Medium

ID: 14258

File Name: phpmyfaq_action_parameter_flaw.nasl

Version: 1.23

Type: remote

Family: CGI abuses

Published: 8/11/2004

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.2

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Information

CPE: cpe:/a:phpmyfaq:phpmyfaq

Required KB Items: www/phpmyfaq

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Ease: No exploit is required

Vulnerability Publication Date: 5/18/2004

Reference Information

CVE: CVE-2004-2255

BID: 10374

Detections

Analytics