Test ID:	1.3.6.1.4.1.25623.1.0.800983
Category:	Web application abuses
Title:	PHP Inventory Multiple Vulnerabilities
Summary:	PHP inventory is prone to multiple vulnerabilities.;; This VT has been deprecated and replaced by the VT 'PHP Inventory 'user' and 'pass' Parameters SQL Injection Vulnerability' (OID: 1.3.6.1.4.1.25623.1.0.802534).
Description:	Summary: PHP inventory is prone to multiple vulnerabilities. This VT has been deprecated and replaced by the VT 'PHP Inventory 'user' and 'pass' Parameters SQL Injection Vulnerability' (OID: 1.3.6.1.4.1.25623.1.0.802534). Vulnerability Insight: Multiple flaws exist due to: - Input passed via the 'user_id' parameter to 'index.php' and via the 'sup_id' parameter is not properly sanitised before being used in an SQL query. - Input passed via the 'user' and 'pass' form field to 'index.php' is not properly sanitised before being used in an SQL query. Vulnerability Impact: Successful exploitation will allow remote attackers to include arbitrary HTML or web scripts in the scope of the browser and allows to obtain and manipulate sensitive information. Affected Software/OS: PHP Inventory version 1.2 and prior. Solution: Update to PHP Inventory version 1.3.2 or later. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-4595 http://secunia.com/advisories/37672 Common Vulnerability Exposure (CVE) ID: CVE-2009-4596 http://www.exploit-db.com/exploits/10370 http://packetstormsecurity.org/0912-exploits/phpinventory-sql.txt XForce ISS Database: phpinventory-index-xss(54667) https://exchange.xforce.ibmcloud.com/vulnerabilities/54667 Common Vulnerability Exposure (CVE) ID: CVE-2009-4597 XForce ISS Database: phpinventory-index-sql-injection(54666) https://exchange.xforce.ibmcloud.com/vulnerabilities/54666
Copyright	Copyright (C) 2010 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.