PT-2005-2494 · Mybloggie · Mybloggie

Alberto Trivero + 1 · Publicado 2005-05-11 · Atualizado 2017-07-11 · CVE-2005-1498

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions myBloggie version 2.1.1

Description The issue allows remote attackers to inject arbitrary web script or HTML via several parameters in viewmode.php and index.php, which are not properly sanitized before being displayed in an error message. Specifically, the year parameter in viewmode.php and the cat id, month no, and post id parameters in index.php are vulnerable.

Recommendations For myBloggie version 2.1.1, consider disabling the vulnerable parameters year, cat id, month no, and post id in viewmode.php and index.php until a patch is available. Restrict access to the error messages that display these parameters to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2005-1498

Produtos afetados

Mybloggie

Referências · 7

• 🔥 https://exploit-db.com/exploits/25612 · Exploit
• 🔥 http://securityfocus.com/bid/13507 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-1498 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/20434 · Nota
• http://marc.info/?l=bugtraq&m=111531904608224&w=2 · Nota
• http://mywebland.com/forums/viewtopic.php?t=180 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/20436 · Nota