Detections
Analytics

PHPNews < 1.2.5 auth.php path Parameter Remote File Inclusion

medium Nessus Network Monitor Plugin ID 2665

Synopsis

The remote host may be tricked into running an executable file.

Description

The remote host is running a version of PHPNews, an open source news
application, that has a remote file inclusion vulnerability in auth.php.
By leveraging this flaw, a attacker can cause arbitrary PHP code to be
executed on the remote host using the permissions of the web server
user.

Solution

Upgrade to version 1.2.5 or higher.

See Also

http://archives.neohapsis.com/archives/bugtraq/2005-03/0026.html

http://newsphp.sourceforge.net/changelog/changelog_1.25.txt

Plugin Details

Severity: Medium

ID: 2665

Family: CGI

Published: 3/2/2005

Updated: 3/6/2019

Nessus ID: 17247

Risk Information

VPR

Risk Factor: Medium

Score: 4.2

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:H/RL:W/RC:X

Vulnerability Information

CPE: cpe:/a:phpnews:phpnews

Reference Information

CVE: CVE-2005-0632

BID: 12696