{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "phpSysInfo 1.x ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "phpSysInfo 2.x.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nphpSysInfo est un programme en langage php qui retourne graphiquement\ndes informations sur syst\u00e8me.\n\n  \n\nUne vuln\u00e9rabilit\u00e9 dans l\u0027\u00e9mulation register_globals permet \u00e0 un\nutilisateur mal intentionn\u00e9 de porter atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des\ndonn\u00e9ees pr\u00e9sentes sur le serveur afin de s\u0027en servir pour ex\u00e9cuter du\ncode arbitraire \u00e0 distance sur les postes clients.\n\n## Solution\n\nAppliquer la mise \u00e0 jour de s\u00e9curit\u00e9 phpSysInfo en passant \u00e0 la version\n2.4.1 disponible \u00e0 l\u0027adresse suivante :\n\n    http://sourceforge.net/project/showfiles.php?group_id=15\n",
  "cves": [],
  "initial_release_date": "2005-11-23T00:00:00",
  "last_revision_date": "2005-11-23T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Hardened-php #22/2005 du 13 novembre    2005 :",
      "url": "http://www.hardened-php.net/advisory_222005.81.html"
    }
  ],
  "reference": "CERTA-2005-AVI-468",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2005-11-23T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans phpSysInfo permet \u00e0 un utilisateur mal\nintentionn\u00e9 de porter atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9ees pr\u00e9sentes sur\nle serveur vuln\u00e9rable pour ensuite ex\u00e9cuter du code arbitraire \u00e0\ndistance sur les postes clients.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans phpSysInfo",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Mise \u00e0 jour de s\u00e9curit\u00e9 pour phpSysInfo en version 2.4.1",
      "url": "http://sourceforge.net/project/showfiles.php?group_id=15"
    }
  ]
}