PT-2005-3906 · Simplog · Simplog

Mustafa Can Bjorn Ipekci + 1 · Publicado 2005-09-27 · Atualizado 2008-09-05 · CVE-2005-3076

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Simplog version 0.9.1

Description The issue allows remote attackers to execute arbitrary SQL commands or trigger SQL error messages. This can be achieved by providing invalid parameters to specific API endpoints, including pid, blogid, cid, or m parameters to "archive.php", or the blogid parameter to "blogadmin.php".

Recommendations For Simplog version 0.9.1, as a temporary workaround, consider validating and sanitizing the pid, blogid, cid, m, and blogid parameters in the "archive.php" and "blogadmin.php" files to prevent SQL injection attacks. Restrict access to these endpoints until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2005-3076

Produtos afetados

Simplog

Referências · 5

• http://simplog.org/bugs/bug.php?op=show&bugid=55 · Nota
• http://secunia.com/advisories/16881 · Nota
• http://securityfocus.com/bid/14897 · Nota
• http://securityreason.com/securityalert/755 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-3076 · Nota de Segurança