This host is running PHP inventory and is prone to SQL injection vulnerability.

Successful exploitation will allow remote attackers to include arbitrary HTML or web scripts in the scope of the browser and allows to obtain and manipulate sensitive information. Impact Level: Application

Upgrade to PHP Inventory version 1.3.2 or later For updates refer to http://www.phpwares.com/content/php-inventory

The flaw is due to an input passed the to 'user' and 'pass' form field in 'index.php' is not properly sanitised before being used in an SQL query.

PHP Inventory version 1.3.1

• http://packetstormsecurity.org/files/107425/INFOSERVE-ADV2011-08.txt
• http://seclists.org/fulldisclosure/2011/Dec/0
• http://www.securityfocus.com/archive/1/520692

---

Updated on 2015-03-25