Pi-hole Web Interface < 3.3 Multiple Vulnerabilities

# SPDX-FileCopyrightText: 2018 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:pi-hole:web_interface";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.108343");
  script_version("2025-11-06T05:40:15+0000");
  script_tag(name:"last_modification", value:"2025-11-06 05:40:15 +0000 (Thu, 06 Nov 2025)");
  script_tag(name:"creation_date", value:"2018-02-18 11:43:37 +0100 (Sun, 18 Feb 2018)");
  script_tag(name:"cvss_base", value:"9.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2025-10-01 14:08:35 +0000 (Wed, 01 Oct 2025)");

  script_cve_id("CVE-2025-34087");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Pi-hole Web Interface < 3.3 Multiple Vulnerabilities");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2018 Greenbone AG");
  script_family("Web application abuses");
  script_dependencies("gb_pi-hole_consolidation.nasl");
  script_mandatory_keys("pi-hole/detected");

  script_tag(name:"summary", value:"The Pi-hole Web Interface (previously AdminLTE) is prone to
  multiple vulnerabilities.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"Multiple flaws exist due to:

  - Not using parameterized SQL queries.

  - XSS attack vectors in the php/auth.php and php/debug.php file.

  - When adding a domain to the allowlist via the web interface, the domain parameter is not
  properly sanitized, allowing an attacker to append OS commands to the domain string. These
  commands are executed on the underlying operating system with the privileges of the Pi-hole
  service user.");

  script_tag(name:"impact", value:"Successful exploitation will allow remote attackers to conduct
  SQL injection, command injection, and cross-site scripting (XSS) attacks.");

  script_tag(name:"affected", value:"Pi-hole Web Interface (previously AdminLTE) prior to version
  3.3.");

  script_tag(name:"solution", value:"Update to version 3.3 or later.");

  script_xref(name:"URL", value:"https://pi-hole.net/2018/02/14/pi-hole-v3-3-released-its-extra-special/");
  script_xref(name:"URL", value:"https://github.com/pi-hole/AdminLTE/pull/674");
  script_xref(name:"URL", value:"https://pulsesecurity.co.nz/advisories/pihole-v3.3-vulns");
  script_xref(name:"URL", value:"https://github.com/advisories/GHSA-j569-xm4x-j2qh");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (!version = get_app_version(cpe: CPE, nofork: TRUE))
  exit(0);

if (version_is_less(version: version, test_version: "3.3")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.3");
  security_message(port: 0, data: report);
  exit(0);
}

exit(99);