Detections
Analytics

Contenido < 4.6.4 class.inuse.php Multiple Parameter Remote File Inclusion

high Nessus Network Monitor Plugin ID 3323

Synopsis

The remote host is vulnerable to an flaw that allows attackers to execute arbitrary commands

Description

The remote host is running Contenido, a web content-management application. This version of Contenido is vulnerable to an unspecified 'command execution' flaw. It is reported that an attacker can, by sending a malformed query, coerce the application into running system commands. This flaw can only be executed if the "allow_url_fopen" and "register_globals" PHP variables are enabled. Successful exploitation would result in loss of confidential data as well as a compromise of system integrity.

Solution

Upgrade to version 4.6.4 or higher.

See Also

http://sourceforge.net/projects/contenidocms

Plugin Details

Severity: High

ID: 3323

Family: CGI

Published: 12/9/2005

Updated: 3/6/2019

Nessus ID: 20292

Risk Information

VPR

Risk Factor: Medium

Score: 5.3

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS v3

Risk Factor: High

Base Score: 7.3

Temporal Score: 7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:contenido:contendio

Reference Information

CVE: CVE-2005-4132

BID: 15790