According to its version number, the remote installation of paFileDB is vulnerable to an attack that would allow the attacker to view the password hash of user accounts, including an administrator account, by making a direct request to the application's 'sessions' directory. This could allow an attacker to perform brute-force attacks on the password hash and gain access to account information.

The vulnerability exists only when session-based authentication is performed, which is not the default.

リモートホストが実行しているpaFileDBのバージョンには、任意のファイルのアップロード、ローカルファイルのインクルード、SQLインジェクション、クロスサイトスクリプティングの問題など、さまざまな脆弱性があります。

遠端主機正在執行的 paFileDB 版本容易受到多種弱點影響，包括任意檔案上傳、本機檔案引入、SQL 注入攻擊和跨網站指令碼問題。

远程主机正在运行的 paFileDB 版本容易受到各种漏洞的影响，包括任意文件上传、本地文件包含、SQL 注入和跨站脚本问题。

The remote host is running a version of paFileDB that is prone to a wide variety of vulnerabilities, including arbitrary file uploads, local file inclusion, SQL injection, and cross-site scripting issues.

The remote host is using PAFileDB.
According to its version number, the remote version of this software is vulnerable to path and password hash disclosure. This may allow an attacker to perform brute force attack on the password hash and gain access to account information.

PHP Arena paFileDB is a web application that is used to manage files.  This version of paFileDB is vulnerable to a remote cross-site-scripting (XSS) flaw. Exploiting the flaw may enable an attacker to inject arbitrary script code into the browser of unsuspecting users.  A successful attack would potentially allow the attacker the ability to view confidential data (cookies, authentication data, and more) or compromise the integrity of the local system via the web browser.  The version of paFileDB is also vulnerable to a remote SQL injection attack.  An attacker exploiting this flaw would only need to be able to send a query to the 'viewall.php' or 'category.php' script.  A successful exploit would give the attacker the ability to read or write confidential data as well as potentially execute arbitrary commands on the remote web server.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
15911	paFileDB sessions Directory Admin Hashed Password Disclosure	Nessus	CGI abuses	2004/12/6	2022/4/11	medium
17329	paFileDB <= 3.1の複数の脆弱性（2）	Nessus	CGI abuses	2005/3/15	2022/6/1	medium
17329	paFileDB <= 3.1 多個弱點 (2)	Nessus	CGI abuses	2005/3/15	2022/6/1	medium
11806	paFileDB <= 3.1 多个漏洞 (1)	Nessus	CGI abuses	2003/7/24	2022/6/1	high
11806	paFileDB <= 3.1 Multiple Vulnerabilities (1)	Nessus	CGI abuses	2003/7/24	2022/6/1	high
17329	paFileDB <= 3.1 Multiple Vulnerabilities (2)	Nessus	CGI abuses	2005/3/15	2022/6/1	medium
2445	PAFileDB Multiple Information Disclosure Vulnerabilities	Nessus Network Monitor	CGI	2004/12/6	2019/3/6	medium
2686	paFileDB < 3.2 XSS and SQL Injection Vulnerabilities	Nessus Network Monitor	CGI	2005/3/9	2019/3/6	medium

検出

プラグインの検索

medium

medium

medium

high

high

medium

medium

medium