(PVS) Signatures - Tenable Network Security

vulnerable to a flaw where users can bypass authentication and gain administrative access
to the application. Successful exploitation would lead to the compromise of confidentiality,
integrity, and availability on the remote machine.
Solution: Upgrade to version 1.6.8 or higher.
WordPress <
CVE-2006-6913
PVS ID: 3881 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a SQL Injection attack.\n\nThe remote host
is running WordPress, a web blog manager written in PHP. The remote version of this
software is reported to be vulnerable to a flaw where a remote attacker can inject malicious
SQL statements into the 'tb_id' parameter of the 'wp-trackback.php' script. An attacker
exploiting this flaw would only need to be able to send queries to the remote web server.
Successful exploitation would result in the attacker executing arbitrary SQL statements on
the database server utilized by WordPress. The path to the vulnerable application is:\n%P
Solution: No solution is known at this time.
CVE-2007-0233
PHPMyAdmin < 2.9.2 rc2 Multiple Vulnerabilities
PVS ID: 3882 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote host
is running phpMyAdmin, a web interface for administering MySQL database servers. This
version of phpMyAdmin is vulnerable to an HTML injection attack as well as several
undisclosed vulnerabilities. The details of the flaws will be released by the vendor;
however, they have released a patched version of phpMyAdmin.
Solution: Upgrade to version 2.9.2 rc2 or higher.
CVE-2007-0204
Socks 4 Proxy Detection
PVS ID: 3883 FAMILY: Generic RISK: INFO NESSUS ID:Not Available
Description: The remote host is acting as a Socks version 4 proxy. This allows remote proxy clients to
tunnel traffic through the host. This sort of behavior is somewhat commonplace on
compromised hosts.
Solution: Ensure that the proxy is authorized with respect to corporate policies and guidelines.
CVE Not available
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1005