Detections
Analytics

phpMyFAQ < 1.6.8 Multiple SQL Injection Vulnerabilities

high Nessus Plugin ID 24001

Language:

Synopsis

The remote web server contains a PHP application that is affected by several SQL injection issues.

Description

The version of phpMyFAQ on the remote host does not properly validate input to the 'uin' parameter of several scripts before using it in database queries. An unauthenticated, remote attacker may be able to leverage these issues to launch SQL injection attacks against the affected application, even bypass authentication and upload arbitrary files that can then be run on the affected host subject to the privileges of the web server user id.

Solution

Upgrade to phpMyFAQ 1.6.8 or later.

See Also

http://www.phpmyfaq.de/advisory_2006-12-15.php

Plugin Details

Severity: High

ID: 24001

File Name: phpmyfaq_168.nasl

Version: 1.18

Type: remote

Family: CGI abuses

Published: 1/10/2007

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.6

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:phpmyfaq:phpmyfaq

Required KB Items: www/phpmyfaq

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Ease: No exploit is required

Vulnerability Publication Date: 12/15/2006

Reference Information

CVE: CVE-2006-6912, CVE-2006-6913

BID: 21944, 21945