Detections
Analytics
PHPSysInfo < 2.4.0 Multiple Vulnerabilities
medium Nessus Network Monitor Plugin ID 3289
Synopsis
The remote host is vulnerable to multiple attack vectors.Description
The remote host is running PHPSysInfo, a PHP application that gives system information via a web interface. This version of PHPSysInfo is vulnerable to a multitude of flaws. These flaws include Cross-Site Scripting (XSS), HTML injection, and a local file inclusion flaw. There is also an inherent risk whenever system information is displayed via a web interface. Of these flaws, the more serious flaw is the local file inclusion vulnerability. An attacker exploiting this flaw would be able to retrieve and display potentially confidential files (such as /etc/passwd). This can lead to confidential materials being downloaded by anonymous users.Solution
Upgrade to version 2.4.0 or higher.See Also
Plugin Details
Severity: Medium
ID: 3289
Family: CGI
Published: 11/14/2005
Updated: 3/6/2019
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5.9
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: Medium
Base Score: 5.6
Temporal Score: 5.4
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:phpsysinfo:phpsysinfo