(PVS) Signatures - Tenable Network Security

Solution: Upgrade to version 2.2.4 or higher.
CVE Not available
Mantis < 0.9.5 / 1.1.0 RC5 view.php HTML Injection
PVS ID: 4326 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to an HTML injection attack.\n\nThe remote
host appears to be running a vulnerable version of Mantis, a bug tracker web application
written in PHP. The reported version number is '%L'. It is reported that versions lower than
1.1.0 are vulnerable to a persistent HTML injection attack. The root of the flaw is in the
way that Mantis handles user-supplied data to the 'view.php' script. An attacker exploiting
this flaw would only need the ability to send HTTP requests to the 'view.php' script.
Successful exploitation would result in arbitrary code being executed within the browser of
other Mantis users.
Solution: Upgrade to version 0.19.5, 1.0.0 RC5 or higher.
CVE-2008-0404
OpenBiblio < 0.6.0 Multiple Vulnerabilities
PVS ID: 4327 FAMILY: Web Servers RISK: HIGH NESSUS ID:Not Available
Description: Synopsis : \n\nThe remote host is missing a critical security patch or
upgrade.\n\nAccording to its version number, the remote host is running a version of
OpenBiblio that is vulnerable to a number of flaws. The reported version info is: \n %L
\n\nOpenBiblio is an open-source, web-based library system. The vendor has released
version 0.6.0 which addresses a number of flaws. An attacker exploiting these flaws would
only require the ability to access the OpenBiblio web interface. Successful exploitation
would allow the attacker to read confidential data and execute malicious code on the local
server, database server and client browser.
Solution: Upgrade to version 0.6.0 or higher.
CVE-2007-6608
Passive Vulnerability Scanner (PVS) Signatures
CMS Made Simple content_css.php templateid Parameter SQL Injection
PVS ID: 4328 FAMILY: CGI RISK: HIGH NESSUS ID:29829
Description: Synopsis :\n\nThe remote web server contains a PHP script that is prone to a SQL injection
attack.\n\n The remote host appears to be running CMS Made Simple ( version %L ), a
content management system written in PHP. The version of CMS Made Simple installed on
the remote host fails to sanitize user-supplied input to the 'templateid' parameter of the
'modules/TinyMCE/content_css.php' script before using it in a database query. Regardless
of PHP's 'magic_quotes_gpc' and 'register_globals' settings, an attacker may be able to
exploit this issue to manipulate database queries, leading to disclosure of sensitive
information, modification of data or other attacks against the underlying database.
Family Internet Services 1127