Zorum <= 3.5 Multiple Remote Vulnerabilities

high Nessus Plugin ID 17312

Language:

Synopsis

The remote web server contains a PHP application that is affected by numerous flaws.

Description

The remote host is running Zorum, an open source electronic forum written in PHP.

The version of Zorum installed on the remote host is prone to numerous flaws, including remote code execution, privilege escalation, and SQL injection.

Solution

Remove the software as it is no longer maintained.

Plugin Details

Severity: High

ID: 17312

File Name: zorum_multiple_vulns.nasl

Version: 1.37

Type: remote

Family: CGI abuses

Published: 3/11/2005

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.3

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:phpoutsourcing:zorum

Required KB Items: www/PHP

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Ease: No exploit is required

Vulnerability Publication Date: 8/18/2005

Reference Information

CVE: CVE-2005-0675, CVE-2005-0676, CVE-2005-0677, CVE-2005-2651, CVE-2005-4619, CVE-2006-3332

BID: 12777, 14601, 16131, 18681

Detections

Analytics