(PVS) Signatures - Tenable Network Security

RunCMS < 1.5.2 Build 20070504 SQL Injection
PVS ID: 3983 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a SQL Injection attack.\n\nThe remote host
is running RunCMS, a web-based content management and messaging system. This version
of RunCMS is vulnerable to a remote SQL injection flaw. Flaws within the SQL-handling
routines of the 'debug_show.php' script are the root cause of this vulnerability. An attacker
exploiting this flaw would only need to be able to send specially crafted queries to the
'debug_show.php' script. Successful exploitation would result in the attacker being able to
execute arbitrary SQL commands on the remote database server.
Solution: Upgrade to version 1.5.2 Build 20070504 or higher.
CVE-2007-2539
Cubecart < 3.0.16 HTTP Response Splitting
PVS ID: 3984 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to an HTTP 'response splitting' attack.\n\nThe
version of CubeCart installed on the remote host fails to properly sanitize user-supplied
input to the 'ccUser' parameter before using it in cart.php and index.php. An
unauthenticated remote attacker may be able to exploit this issue to insert false HTTP
header data into the client request.
Solution: Upgrade to version 3.0.16 or higher.
CVE-2007-2550
MySQL < 5.0.40 IF Query NULL Dereference DoS
PVS ID: 3985 FAMILY: Database
RISK:
MEDIUM
NESSUS ID:25198
Description: Synopsis :\n\nThe remote database server is prone to a denial of service attack.\n\nThe
version of MySQL installed on the remote host is reportedly affected by a denial of service
vulnerability that may be triggered with a specially crafted IF query. An attacker who can
execute arbitrary SELECT statements may be able to leverage this issue to crash the
affected service.
Solution: Upgrade to version 5.0.40 or higher.
CVE-2007-2583
Passive Vulnerability Scanner (PVS) Signatures
SNORT Intrusion Detection System (IDS) Detection
PVS ID: 3986 FAMILY: Generic RISK: INFO NESSUS ID:Not Available
Family Internet Services 1033