Detections
Analytics
phpGroupWare <= 0.9.16.003 Multiple Vulnerabilities
high Nessus Plugin ID 15983
Language:
Synopsis
A remote web application is vulnerable to several flaws.Description
The remote host seems to be running PhpGroupWare, a multi-user groupware suite written in PHP.The remote version of this software is vulnerable to multiple issues :
- A cross-site scripting issue may allow an attacker to steal the credentials of third-party users of the remote host. (CVE-2004-1384)
- A SQL injection vulnerability may allow an attacker to execute arbitrary SQL statements against the remote database. (CVE-2004-1383)
- An information disclosure vulnerability exists that is triggered when a specially crafted URL request is sent to the 'index.php' script. (CVE-2004-1385)
Solution
Update to the newest version of this software.Plugin Details
Severity: High
ID: 15983
File Name: phpgroupware_xss_and_sql.nasl
Version: 1.22
Type: remote
Family: CGI abuses
Published: 12/16/2004
Updated: 6/4/2024
Configuration: Enable thorough checks
Supported Sensors: Nessus
Enable CGI Scanning: true
Risk Information
VPR
Risk Factor: Medium
Score: 6.3
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:phpgroupware:phpgroupware
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No exploit is required
Vulnerability Publication Date: 12/14/2004
Reference Information
CVE: CVE-2004-1383, CVE-2004-1384, CVE-2004-1385
BID: 11952