The remote host is running phpSysInfo, a PHP application that parses the /proc entries on Linux/Unix systems and displays them in HTML.

The installed version of phpSysInfo on the remote host has a design flaw in its globalization layer such that the script's variables can be overwritten independent of PHP's 'register_globals' setting.  By exploiting this issue, an attacker may be able to read arbitrary files on the remote host and even execute arbitrary PHP code, both subject to the privileges of the web server user id.

In addition, the application fails to sanitize user-supplied input before using it in dynamically-generated pages, which can be used to conduct cross-site scripting and HTTP response splitting attacks.

Several vulnerabilities have been discovered in phpsysinfo, a PHP based host information application. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-0870     Maksymilian Arciemowicz discovered several cross site     scripting problems, of which not all were fixed in DSA     724.

  - CVE-2005-3347     Christopher Kunz discovered that local variables get     overwritten unconditionally and are trusted later, which     could lead to the inclusion of arbitrary files.

  - CVE-2005-3348     Christopher Kunz discovered that user-supplied input is     used unsanitised, causing a HTTP Response splitting     problem.

リモートホストは、phpSysInfoを実行しています。これは、Linux/Unixシステムの/procエントリを解析し、HTMLで表示するPHPアプリケーションです。

リモートホストにインストールされているバージョンのphpSysInfoのグローバリゼーションレイヤーに設計上の欠陥があり、スクリプトの変数がPHPの「register_globals」設定に関係なく上書きされる可能性があります。攻撃者が、この問題を悪用して、WebサーバーユーザーIDの権限に従って、リモートホストで任意のファイルを読み取ったり、任意のPHPコードを実行したりする可能性があります。

さらに、アプリケーションは、動的に生成されたページで使用する前に、ユーザー指定の入力をサニタイズできないため、クロスサイトスクリプティングおよびHTTP応答分割攻撃を仕掛けるために使用される可能性があります。

The remote host is affected by the vulnerability described in GLSA-200511-18 (phpSysInfo: Multiple vulnerabilities)

    Christopher Kunz from the Hardened-PHP Project discovered     that phpSysInfo is vulnerable to local file inclusion, cross-site     scripting and a HTTP Response Splitting attacks.
  Impact :

    A local attacker may exploit the file inclusion vulnerability by     sending malicious requests, causing the execution of arbitrary code     with the rights of the user running the web server. A remote attacker     could exploit the vulnerability to disclose local file content.
    Furthermore, the cross-site scripting issues gives a remote attacker     the ability to inject and execute malicious script code in the user's     browser context or to steal cookie-based authentication credentials.
    The HTTP response splitting issue give an attacker the ability to     perform site hijacking and cache poisoning.
  Workaround :

    There is no known workaround at this time.

遠端主機正在執行 phpSysInfo，此 PHP 應用程式可剖析 Linux/Unix 系統上的 /proc 項目並以 HTML 顯示。

遠端主機上安裝的 phpSysInfo 版本在其全球化層中有一個設計缺陷，不論 PHP 的「register_globals」設定為何，使用者皆可覆寫此指令碼的變數。攻擊者可利用此問題，讀取遠端主機上的任意檔案，甚至執行任意 PHP 程式碼，兩者皆需使用 Web 伺服器使用者 ID 的權限。

此外，此應用程式未清理使用者提供的輸入，便將其用於動態產生的頁面，攻擊者可利用此問題來執行跨網站指令碼攻擊和 HTTP 回應分割攻擊。

Several vulnerabilities have been discovered in phpsysinfo, a PHP based host information application that is included in phpgroupware.
The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-0870     Maksymilian Arciemowicz discovered several cross site     scripting problems, of which not all were fixed in DSA     724.

  - CVE-2005-3347     Christopher Kunz discovered that local variables get     overwritten unconditionally and are trusted later, which     could lead to the inclusion of arbitrary files.

  - CVE-2005-3348     Christopher Kunz discovered that user-supplied input is     used unsanitised, causing a HTTP Response splitting     problem.

Several vulnerabilities have been discovered in egroupware, a web-based groupware suite. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-0870     Maksymilian Arciemowicz discovered several cross site     scripting problems in phpsysinfo, which are also present     in the imported version in egroupware and of which not     all were fixed in DSA 724.

  - CVE-2005-2600     Alexander Heidenreich discovered a cross-site scripting     problem in the tree view of FUD Forum Bulletin Board     Software, which is also present in egroupware and allows     remote attackers to read private posts via a modified     mid parameter.

  - CVE-2005-3347     Christopher Kunz discovered that local variables get     overwritten unconditionally in phpsysinfo, which are     also present in egroupware, and are trusted later, which     could lead to the inclusion of arbitrary files.

  - CVE-2005-3348     Christopher Kunz discovered that user-supplied input is     used unsanitised in phpsysinfo and imported in     egroupware, causing a HTTP Response splitting problem.

The remote host is running phpSysInfo, a PHP script that monitors and reports on local *nix system resources utilization.  This version of phpSysInfo is vulnerable to a remote Cross-Site Scripting attack.  An attacker exploiting this flaw would need to be able to convince a user to browse a malicious URI.  Successful exploitation could lead to a loss of integrity as code would be executed by the browser within the security context of the vulnerable web site.

The remote host is running PHPSysInfo, a PHP application that gives system information via a web interface.  This version of PHPSysInfo is vulnerable to a multitude of flaws.  These flaws include Cross-Site Scripting (XSS), HTML injection, and a local file inclusion flaw.  There is also an inherent risk whenever system information is displayed via a web interface.  Of these flaws, the more serious flaw is the local file inclusion vulnerability.  An attacker exploiting this flaw would be able to retrieve and display potentially confidential files (such as /etc/passwd).  This can lead to confidential materials being downloaded by anonymous users. 

ID	名稱	產品	系列	已發布	已更新	嚴重性
20215	phpSysInfo < 2.4.1 Multiple Vulnerabilities	Nessus	CGI abuses	2005/11/16	2022/4/11	medium
22763	Debian DSA-897-1 : phpsysinfo - programming errors	Nessus	Debian Local Security Checks	2006/10/14	2021/1/4	medium
20215	phpSysInfo < 2.4.1の複数の脆弱性	Nessus	CGI abuses	2005/11/16	2022/4/11	medium
20262	GLSA-200511-18 : phpSysInfo: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2005/12/7	2021/1/6	medium
20215	phpSysInfo < 2.4.1 多個弱點	Nessus	CGI abuses	2005/11/16	2022/4/11	medium
22764	Debian DSA-898-1 : phpgroupware - programming errors	Nessus	Debian Local Security Checks	2006/10/14	2021/1/4	medium
22765	Debian DSA-899-1 : egroupware - programming errors	Nessus	Debian Local Security Checks	2006/10/14	2021/1/4	medium
2748	phpSysInfo < 2.5 Multiple Script XSS	Nessus Network Monitor	CGI	2005/3/23	2019/3/6	low
3289	PHPSysInfo < 2.4.0 Multiple Vulnerabilities	Nessus Network Monitor	CGI	2005/11/14	2019/3/6	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

low

medium