Detections
Analytics
LiveZilla < 5.1.1.0 Multiple Vulnerabilities
medium Nessus Plugin ID 71441
Language:
Synopsis
The remote web server contains a PHP application that is affected by multiple vulnerabilities.Description
The version of LiveZilla hosted on the remote web server is affected by multiple vulnerabilities :- The application saves admin login details in a 1 click XML file. This allows a local attacker to obtain admin login credentials. (CVE-2013-6223)
- The application is affected by multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
(CVE-2013-6224, CVE-2013-7002)
- The application is affected by a local file inclusion vulnerability that can be exploited to view arbitrary files or execute arbitrary PHP code on the remote host.
(CVE-2013-6225)
Solution
Upgrade to LiveZilla version 5.1.1.0 or later.See Also
https://curesec.com/data/advisories/Curesec-2013-1006.pdf
https://curesec.com/data/advisories/Curesec-2013-1007.pdf
https://curesec.com/data/advisories/Curesec-2013-1008.pdf
http://www.livezilla.net/board/index.php?/topic/163-livezilla-changelog/
Plugin Details
Severity: Medium
ID: 71441
File Name: livezilla_5_1_1_0.nasl
Version: 1.10
Type: remote
Family: CGI abuses
Published: 12/14/2013
Updated: 5/28/2024
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.4
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2013-7002
Vulnerability Information
CPE: cpe:/a:livezilla:livezilla
Required KB Items: installed_sw/LiveZilla, www/PHP
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 11/21/2013
Vulnerability Publication Date: 11/28/2013
Reference Information
CVE: CVE-2013-6223, CVE-2013-6224, CVE-2013-6225, CVE-2013-7002