PT-2005-4269 · Simple Php Blog · Simple Php Blog

Nenad Jovanovic · Publicado 2005-11-03 · Atualizado 2018-10-19 · CVE-2005-3473

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Simple PHP Blog versions 0.4.5 and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters in certain PHP files. This is achieved through the entry, blog subject, and blog text parameters, which involve the temp subject variable in preview cgi.php and preview static cgi.php files. Additionally, the scheme name and bg color parameters, involving the preset name and result variables in colors.php, are also vulnerable.

Recommendations For Simple PHP Blog versions 0.4.5 and earlier, consider disabling the preview cgi.php and preview static cgi.php files, as well as restricting access to the colors.php file until a patch is available. Avoid using the entry, blog subject, blog text, scheme name, and bg color parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2005-3473

Produtos afetados

Simple Php Blog

Referências · 12

• 🔥 https://exploit-db.com/exploits/26461 · Exploit
• 🔥 https://exploit-db.com/exploits/26463 · Exploit
• 🔥 https://exploit-db.com/exploits/26462 · Exploit
• http://osvdb.org/20436 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-3473 · Nota de Segurança
• http://osvdb.org/20438 · Nota
• http://securityfocus.com/bid/15283 · Nota
• http://securityfocus.com/archive/1/415463 · Nota
• http://securityreason.com/securityalert/138 · Nota
• http://osvdb.org/20437 · Nota
• http://secunia.com/advisories/17404 · Nota
• http://seclab.tuwien.ac.at/advisories/TUVSA-0511-001.txt · Aviso do Fabricante