PT-2005-2496 · Mybloggie · Mybloggie

Alberto Trivero + 1 · Publicado 2005-05-11 · Atualizado 2017-07-11 · CVE-2005-1500

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions myBloggie versions 2.1.1 through 2.1.3

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters in different modes, including the keyword parameter in "search.php", the date no parameter in viewdate mode, the cat id parameter in viewcat mode, the month no or year parameter in viewmonth mode, or the post id parameter in viewid mode to "index.php".

Recommendations For myBloggie versions 2.1.1 through 2.1.3, consider restricting access to the vulnerable parameters keyword, date no, cat id, month no, year, and post id in their respective modes until a patch is available. As a temporary workaround, avoid using these parameters in the affected API endpoints. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2005-1500

Produtos afetados

Mybloggie

Referências · 9

• 🔥 http://mywebland.com/forums/viewtopic.php?t=180 · Exploit
• 🔥 https://exploit-db.com/exploits/1023 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/20439 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-1500 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=111722848308367&w=2 · Nota
• http://securityfocus.com/bid/13507 · Nota
• http://marc.info/?l=bugtraq&m=111531904608224&w=2 · Nota
• http://securityfocus.com/bid/15017 · Nota
• http://secunia.com/advisories/14980 · Aviso do Fabricante