Description

This alert was generated using only banner information. It may be a false positive.

PHP applications can be manipulated into opening arbitrary files on the server, rather than those uploaded by the user.

Affected PHP versions (up to 3.0.16, 4.0.2).

Remediation

Upgrade PHP to the latest version.

References

BID 1649

PHP Homepage

Related Vulnerabilities

WordPress Plugin Multivendor Marketplace Solution for WooCommerce-WC Marketplace Cross-Site Request Forgery (3.7.3)

WordPress Plugin JW Player 6 Cross-Site Scripting (2.1.14)

WordPress Plugin Gallery by BestWebSoft Arbitrary File Disclosure (3.8.3)

WordPress Plugin Product Catalog SQL Injection (3.1.2)

WordPress Plugin Beautiful Stat Counter for WordPress-Everest Counter Lite includes Backdoor [Only if downloaded via the vendor website] (2.0.7)

Severity

Medium

Classification

CVE-2000-0860 CWE-538 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Information Disclosure