Nessus Plugin #11966

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

Remote Code Execution in PHP Ping

Family:

CGI abuses

Category:

infos

Copyright:

This script is Copyright (C) 2003 Noam Rathaus

Summary:

Detect PHP Ping Code Execution

Version:

$Revision: 1.6 $

Cve_id:

-

Bugtraq_id:

9309

Xrefs:

-

Description:

php-ping is a simple php script executing the 'ping' command.

A bug in this script allows users to execute arbitary commands.
The problem is based upon the fact that not all user inputs are filtered
correctly: although $host is filtered using preg_replace(), the $count
variable is passed unfiltered to the system() command.

Risk factor : High