(PVS) Signatures - Tenable Network Security

Description: Synopsis :\n\nThe remote web server contains a script which is vulnerable to a SQL
injection attack.\n\nThe remote host is running an old version of phpBB, a bulletin board
application implemented in PHP. It is reported that phpBB versions prior 2.0 are vulnerable
to multiple security issues including SQL injection, arbitrary command execution, database
corruption and denial of service.
Solution: Upgrade to phpBB 2.0 or higher.
CVE-2002-0533
WackoWiki < R4.0 TextSearch XSS
PVS ID: 1730 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a cross-site scripting (XSS) attack.\n\nThe
remote host is running a vulnerable WackoWiki, a lightweight Wiki-clone implemented in
PHP. It is reported that WackoWiki R3.5 is susceptible to a cross-site scripting
vulnerability in its textsearch form. This may allow for theft of cookie-based authentication
credentials or other attacks.
Solution: Upgrate to WackoWiki R4.0 or higher.
CVE-2004-2624
PScript PForum < 1.26 User Profile XSS
PVS ID: 1731 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:Not Available
Description: The remote host is running a vulnerable version of PForum, a web forum software
implemented in PHP. It is reported that versions prior 1.26 are vulnerable to cross-site
scripting (XSS). An attacker may include malicious HTML in the 'AIM ID' and 'IRC
Server' fields of his profile. This malicious code may be rendered by a victim's browser
displaying the attacker profile. It may permit the attacker to steal cookie-based
authentication credentials or to exploit latent security flaws in web browsers.
Solution: Upgrade to PScript PForum 1.26 or higher.
CVE-2004-1716
Powie PHP Forum < 1.15 Multiple Vulnerabilities
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 1732 FAMILY: Web Servers RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote web server contains a script which is vulnerable to a SQL
injection attack.\n\nThe remote host is running an old version of Powie PHP Forum, a web
forum software implemented in PHP. It is reported that version prior 1.15 are vulnerable to
multiple security issue including cross-site scripting and SQL injection. An attacker may
gain access on the forum as a specific user or as an administrator or steal a victim's
cookie-based authentication credentials using malicious HTML code.
Family Internet Services 440