Nessus Plugin #15433

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

PHP-Fusion members.php SQL injection

Family:

CGI abuses

Category:

infos

Copyright:

This script is Copyright (C) 2004 David Maciejak

Summary:

Checks the version of the remote PHP-Fusion

Version:

$Revision: 1.4 $

Cve_id:

-

Bugtraq_id:

11296, 12425

Xrefs:

OSVDB:10437

Description:

The remote host is using PHP-Fusion, a content management system,
written in PHP which uses MySQL.

A vulnerability exists in the remote version of this software
which may allow an attacker to inject arbitrary SQL code and
possibly execute arbitrary code, due to improper validation of
user supplied input in the 'rowstart' parameter of script
'members.php'.

In addition to this, the remote version of this software also
contains an information disclosure vulnerability which may give
an attacker more information about the setup of the remote
host.

Solution : Upgrade to the latest version of this software
Risk factor : High