Detections
Analytics
Interchange < 5.0.2 / 5.2.1 Multiple Vulnerabilities (SQLi, Code Exe)
high Nessus Plugin ID 19779
Language:
Synopsis
The remote web server uses an application server that may be prone to SQL injection or cross-site scripting attacks.Description
The remote host appears to be running Interchange, an open source application server that handles state management, authentication, session maintenance, click trails, filtering, URL encodings, and security policy.According to its banner, the installed version of Interchange fails to sanitize input passed through to the 'forum/submit.html' page, which may lead to either SQL injection or cross-site scripting attacks.
Solution
Upgrade to Interchange 5.0.2 / 5.2.1 or later.See Also
Plugin Details
Severity: High
ID: 19779
File Name: interchange_521.nasl
Version: 1.18
Type: remote
Family: CGI abuses
Published: 9/26/2005
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.2
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:interchange_development_group:interchange
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: No exploit is required
Vulnerability Publication Date: 9/22/2005
Reference Information
CVE: CVE-2005-3072, CVE-2005-3073
BID: 14931