CGI Generic Local File Inclusion (2nd pass)

medium Nessus Plugin ID 42872

Synopsis

Arbitrary code may be run on this server.

Description

The remote web server hosts CGI scripts that fail to adequately sanitize request strings. By leveraging this issue, an attacker may be able to include a local file and disclose its contents, or even execute arbitrary code on the remote host.

Solution

Restrict access to the vulnerable application. Contact the vendor for a patch or upgrade.

See Also

https://en.wikipedia.org/wiki/Remote_File_Inclusion

Plugin Details

Severity: Medium

ID: 42872

File Name: torture_cgi_local_file_inclusion2.nasl

Version: 1.23

Type: remote

Family: CGI abuses

Published: 11/19/2009

Updated: 1/19/2021

Supported Sensors: Nessus

Vulnerability Information

Required KB Items: Settings/enable_web_app_tests

Reference Information

CWE: 473, 632, 714, 727, 73, 78, 928, 929, 98