vendor:
PHP Planner
by:
cp77fk4r
8,8
CVSS
HIGH
Full Path Disclosure, Remote System Init, Cross Site Request Forgery, SQL Injection
200, 352, 89, 89
CWE
Product Name: PHP Planner
Affected Version From: v.0.4
Affected Version To: v.0.4
Patch Exists: YES
Related CWE: N/A
CPE: phpplanner
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: PHP
2010
phpplanner <= PHP Planner v.0.4 Multiple Vulnerabilities
Full Path Disclosure (FPD) vulnerabilities enable the attacker to see the path to the webroot/file. Remote System Init vulnerability allows the attacker to reset the system by entering the page (.php.lock). Cross Site Request Forgery (CSRF) is an attack which forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated. SQL Injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution.
Mitigation:
Implement input validation, use parameterized queries, use stored procedures, use least privilege, use web application firewalls, use secure coding practices, use secure authentication and authorization, use secure session management, use secure data transfer, use secure data storage, use secure data deletion, use secure data backup, use secure data archiving, use secure data recovery, use secure data encryption, use secure data integrity, use secure data access control, use secure data logging, use secure data auditing.
