PT-2005-4913 · Mybloggie · Mybloggie

Publicado 2005-12-14 · Atualizado 2018-10-19 · CVE-2005-4225

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions myBloggie version 2.1.3 beta

Description The issue allows remote attackers to execute arbitrary SQL commands via multiple parameters in various PHP files, including category in "add.php", cat desc in "addcat.php", level and user in "adduser.php", post id in "del.php", cat id in "delcat.php", comment id in "delcomment.php", id in "deluser.php", post id and category in "edit.php", cat id and cat desc in "editcat.php", and id, level, and user in "edituser.php".

Recommendations For myBloggie version 2.1.3 beta, consider temporarily restricting access to the vulnerable parameters, such as category, cat desc, level, user, post id, cat id, comment id, and id, in the respective PHP files until a patch is available. Avoid using these parameters in the affected API endpoints until the issue is resolved.

Correção

Identificadores relacionados

CVE-2005-4225

Produtos afetados

Mybloggie

Referências · 18

• http://osvdb.org/21667 · Nota
• http://osvdb.org/21670 · Nota
• http://osvdb.org/21664 · Nota
• http://osvdb.org/21669 · Nota
• http://osvdb.org/21662 · Nota
• http://glide.stanford.edu/yichen/research/sec.pdf · Nota
• http://secunia.com/advisories/18024 · Aviso do Fabricante
• http://vupen.com/english/advisories/2005/2862 · Nota
• http://osvdb.org/21666 · Nota
• http://securityfocus.com/archive/1/419280/100/0/threaded · Nota
• http://securityfocus.com/archive/1/419487/100/0/threaded · Nota
• http://osvdb.org/21665 · Nota
• http://osvdb.org/21659 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-4225 · Nota de Segurança
• http://osvdb.org/21661 · Nota