(PVS) Signatures - Tenable Network Security

PVS ID: 1562 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:11538
Description: eZ Publish (a content management system) is installed on the remote host. An attacker may
retrieve the file 'settings/site.ini' and gather interesting information about the remote host.
Solution: Restrict remote access to .ini files.
CVE Not available
Ocean12 Guestbook XSS
PVS ID: 1563 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:11537
Description: The remote host is running Ocean12 Guestbook, a set of scripts designed to manage an
on-line guestbook. There is a flaw in this program which may be abused by attackers to
inject malicious HTML code in the remote site, which may be used to steal the cookies of
legitimate users.
Solution: No solution is known at this time.
CVE Not available
Super Guestbook superguestconfig Admin Password Disclosure
PVS ID: 1564 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:11536
Description: The remote host is running SuperGuestBook, a set of PHP scripts designed to manage an
interactive guestbook. There is a flaw in this version which may allow an attacker to
retrieve the configuration file of this setup, which contains the password of the
administrator.
Solution: Restrict remote access to the 'superguestconfig' file.
CVE Not available
Instaboard index.cfm SQL Injection
PVS ID: 1565 FAMILY: CGI RISK: HIGH NESSUS ID:11532
Description: Synopsis :\n\nThe remote web server contains a script which is vulnerable to a SQL
injection attack.\n\nThe remote host is running NetPleasure's Instaboard, a web-interface
designed to manage online forums. There is a vulnerability in this release which allows an
attacker to perform a SQL injection attack through the CGI 'index.cfm'.
Solution: No solution is known at this time.
CVE Not available
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 402