The remote web server contains PHP scripts that are prone to several flaws, including possibly arbitrary code execution. Description : The remote host is running phpWebLog, a news and content management system written in PHP. Due to improper filtering done by 'search.php' a remote attacker can cause the phpWebLog product to include arbitrary HTML and/or JavaScript. An attacker may use this bug to perform a cross site scripting attack using the remote host. There are also reportedly two flaws that, if PHP's 'register_globals' setting is enabled, allow for local file disclosure and arbitrary code execution.

Disable this script.

• http://www.securiteam.com/unixfocus/5GP0C1PF5W.html

---

Updated on 2015-03-25