Executive Summary

Summary
Title New phpsysinfo packages fix cross site scripting
Informations
Name DSA-724 First vendor Publication 2005-05-18
Vendor Debian Last vendor Modification 2005-05-18
Severity (Vendor) N/A Revision 1

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Cvss Base Score 4.3 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Maksymilian Arciemowicz discoverd several cross site scripting issues in phpsysinfo, a PHP based host information application.

For the stable distribution (woody) these problems have been fixed in version 2.0-3woody2.

For the testing (sarge) and unstable (sid) distribution these problems have been fixed in version 2.3-3.

We recommend that you upgrade your phpsysinfo package.

Original Source

Url : http://www.debian.org/security/2005/dsa-724

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1

OpenVAS Exploits

Date Description
2008-09-04 Name : FreeBSD Ports: phpSysInfo
File : nvt/freebsd_phpSysInfo.nasl
2008-01-17 Name : Debian Security Advisory DSA 724-1 (phpsysinfo)
File : nvt/deb_724_1.nasl
2008-01-17 Name : Debian Security Advisory DSA 897-1 (phpsysinfo)
File : nvt/deb_897_1.nasl
2008-01-17 Name : Debian Security Advisory DSA 898-1 (phpgroupware)
File : nvt/deb_898_1.nasl
2008-01-17 Name : Debian Security Advisory DSA 899-1 (egroupware)
File : nvt/deb_899_1.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
14950 phpSysInfo system_footer.php Multiple Parameter XSS

phpSysInfo contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'text[language]', 'text[template]', or 'VERSION' variables upon submission to the system_footer.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.
14949 phpSysInfo index.php sensor_program Parameter XSS

phpSysInfo contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'sensor_program' variable upon submission to the index.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

Nessus® Vulnerability Scanner

Date Description
2006-10-14 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-897.nasl - Type : ACT_GATHER_INFO
2006-10-14 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-898.nasl - Type : ACT_GATHER_INFO
2006-10-14 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-899.nasl - Type : ACT_GATHER_INFO
2006-05-13 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_50457509d05e11d99aed000e0c2e438a.nasl - Type : ACT_GATHER_INFO
2005-11-16 Name : The remote web server contains a PHP application that is affected by multiple...
File : phpsysinfo_241.nasl - Type : ACT_GATHER_INFO
2005-05-19 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-724.nasl - Type : ACT_GATHER_INFO
2005-03-24 Name : The remote web server contains two PHP scripts that are prone to cross-site s...
File : phpsysinfo_multiple_xss.nasl - Type : ACT_ATTACK

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:34:02
  • Multiple Updates