Vulnerabilities > CVE-2004-1219 - Unspecified vulnerability in PHP Arena Pafiledb 3.1
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
NONE Availability impact
NONE Summary
paFileDB 3.1, when using sessions authentication and while the administrator logs on, allows remote attackers to read the administrator's password hash and conduct brute force password guessing attacks by listing the contents of the sessions directory and reading the associated file for the administrator session.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |
Nessus
NASL family CGI abuses NASL id PAFILEDB_MULTIPLE_VULNS.NASL description The remote host is running a version of paFileDB that is prone to a wide variety of vulnerabilities, including arbitrary file uploads, local file inclusion, SQL injection, and cross-site scripting issues. last seen 2020-06-01 modified 2020-06-02 plugin id 17329 published 2005-03-15 reporter This script is Copyright (C) 2005-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/17329 title paFileDB <= 3.1 Multiple Vulnerabilities (2) NASL family CGI abuses NASL id PAFILEDB_CMD_EXEC.NASL description The remote host is running a version of paFileDB that is prone to a wide variety of vulnerabilities, including arbitrary file uploads, local file inclusion, SQL injection, and cross-site scripting issues. last seen 2020-06-01 modified 2020-06-02 plugin id 11806 published 2003-07-24 reporter This script is Copyright (C) 2003-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/11806 title paFileDB <= 3.1 Multiple Vulnerabilities (1) NASL family CGI abuses NASL id PAFILEDB_PASSWD_DISCLOSURE.NASL description According to its version number, the remote installation of paFileDB is vulnerable to an attack that would allow the attacker to view the password hash of user accounts, including an administrator account, by making a direct request to the application last seen 2020-06-01 modified 2020-06-02 plugin id 15911 published 2004-12-06 reporter This script is Copyright (C) 2004-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/15911 title paFileDB sessions Directory Admin Hashed Password Disclosure