Vulnerabilities > CVE-2005-0327 - Remote Security vulnerability in PHP Arena Pafiledb 3.1

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
php-arena
nessus
NVD
Published: 2005-05-02
Updated: 2017-07-11

Summary

pafiledb.php in Pafiledb 3.1 may allow remote attackers to execute arbitrary PHP code via a modified action parameter that is used in an include statement for login.php.

Vulnerable Configurations

Part Description Count
Application
Php_Arena
1

Nessus

  • NASL familyCGI abuses
    NASL idPAFILEDB_MULTIPLE_VULNS.NASL
    descriptionThe remote host is running a version of paFileDB that is prone to a wide variety of vulnerabilities, including arbitrary file uploads, local file inclusion, SQL injection, and cross-site scripting issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id17329
    published2005-03-15
    reporterThis script is Copyright (C) 2005-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/17329
    titlepaFileDB <= 3.1 Multiple Vulnerabilities (2)
  • NASL familyCGI abuses
    NASL idPAFILEDB_CMD_EXEC.NASL
    descriptionThe remote host is running a version of paFileDB that is prone to a wide variety of vulnerabilities, including arbitrary file uploads, local file inclusion, SQL injection, and cross-site scripting issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id11806
    published2003-07-24
    reporterThis script is Copyright (C) 2003-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/11806
    titlepaFileDB <= 3.1 Multiple Vulnerabilities (1)

References