Nessus Plugin #16075

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

[GLSA-200412-27] PHProjekt: Remote code execution vulnerability

Family:

Gentoo Local Security Checks

Category:

infos

Copyright:

(C) 2004 Michel Arboi

Summary:

PHProjekt: Remote code execution vulnerability

Version:

$Revision: 1.1 $

Cve_id:

-

Bugtraq_id:

-

Xrefs:

GLSA:200412-27

Description:

The remote host is affected by the vulnerability described in GLSA-200412-27
(PHProjekt: Remote code execution vulnerability)


cYon discovered that the authform.inc.php script allows a remote
user to define the global variable $path_pre.

Impact

A remote attacker can exploit this vulnerability to force
authform.inc.php to download and execute arbitrary PHP code with the
privileges of the web server user.

Workaround

There is no known workaround at this time.

References:
http://www.phprojekt.com/modules.php?op=modload&name=News&file=article&sid=193&mode=thread&order=0


Solution:
All PHProjekt users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apps/phprojekt-4.2-r2"


Risk factor : High