Detections
Analytics
WHM AutoPilot < 2.5.20 Multiple Remote Vulnerabilities
high Nessus Plugin ID 16070
Language:
Synopsis
The remote web server contains a PHP application that suffers from several vulnerabilities.Description
The remote web server is running WHM AutoPilot, a script designed to administer a web-hosting environment.The remote version of this software is vulnerable to various flaws that may allow an attacker to execute arbitrary commands on the remote host, obtain information about the remote host's PHP installation, and launch cross-site scripting attacks.
Solution
Upgrade to WHM AutoPilot version 2.5.20 or later.See Also
http://www.gulftech.org/?node=research&article_id=00059-12272004
Plugin Details
Severity: High
ID: 16070
File Name: whm_autopilot_file_include.nasl
Version: 1.19
Type: remote
Family: CGI abuses
Published: 12/28/2004
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.3
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2004-1421
CVSS v3
Risk Factor: High
Base Score: 7.3
Temporal Score: 6.6
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Required KB Items: www/PHP
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No exploit is required
Vulnerability Publication Date: 12/28/2004
Reference Information
CVE: CVE-2004-1420, CVE-2004-1421, CVE-2004-1422
BID: 12119