(PVS) Signatures - Tenable Network Security

potential leaking of confidential data which may lead to a more sophisticated future attack.
Solution: No solution is known at this time.
CVE-2005-0837
CoolForum SQL and XSS Vulnerabilities
PVS ID: 2725 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:17597
Description: Synopsis :\n\nThe remote web server contains a script that is vulnerable to a SQL injection
attack.\n\nThe remote host is running CoolForum, a bulletin board written in PHP. This
version of CoolForum is vulnerable to at least two (2) remote attacks. Specifically, a SQL
injection attack affects the 'entete.php' and 'register.php' scripts. An attacker exploiting
these flaws would send a malformed query to the questionable scripts. A successful exploit
would result in the reading and writing of confidential data. In addition, the attacker may be
able to execute arbitrary code on the remote webserver.\n\nMultiple HTML injection and
Cross-Site Scripting (XSS) flaws have also been reported to exist within this version of
CoolForum. An attacker exploiting these flaws would typically need to be able to convince
a user to browse a malicious URI. A successful attack would result in the theft of
potentially confidential client data (cookies, authentication credentials, and more) or
malicious code being executed within the client browser.
Solution: Upgrade to version 0.8.1 or higher.
CVE-2005-0857
PHP-Fusion < 5.0.2 setuser.php HTML Injection Vulnerability
PVS ID: 2726 FAMILY: CGI RISK: LOW NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to an HTML injection attack.\n\nThe remote
host is running a version of PHP-Fusion that is vulnerable to an HTML injection flaw.
Specifically, the setuser.php script fails to properly sanitize input data via the 'user_name'
and 'user_pass' parameters. An attacker exploiting this flaw would typically need to be able
to convince a remote user to browse to a malicious URI. A successful attack would yield
potentially confidential data (cookies, credentials) as well as potentially execute malicious
code within the context of the vulnerable server.
Solution: Upgrade to version 5.0.2 or higher.
CVE Not available
Panasonic Camera Detection
PVS ID: 2727 FAMILY: Web Servers
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:Not Available
Family Internet Services 701