HTTP: Bacula Web report.php Multiple Vulnerabilities
This signature detects attempts to exploit multiple known vulnerabilities in Bacula-web. An attacker can steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Extended Description
Bacula-web is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Bacula-web 5.0.3 and 1.38.9_1 are vulnerable; other versions may also be affected.
Affected Products
Bacula-web bacula-web
Short Name
HTTP:PHP:BACULA-WEB-REPORT
Severity
Minor
Recommended
False
Recommended Action
Drop
Category
HTTP
Keywords
Bacula Multiple Vulnerabilities Web bid:46765 report.php
Release Date
03/22/2011
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3336
False Positive
Unknown
Vendors
Bacula-web