PT-2006-1397 · Webspot · Webspotblogging

Aliaksandr Hartsuyeu · Publicado 2006-01-19 · Atualizado 2018-10-19 · CVE-2006-0324

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebspotBlogging version 3.0

Description The issue allows remote attackers to execute arbitrary SQL commands and bypass authentication. This is achieved via the username parameter to the "login.php" endpoint.

Recommendations For WebspotBlogging version 3.0, update to a version that fixes this issue, as using the vulnerable version may allow attackers to bypass authentication and execute arbitrary SQL commands. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2006-0324

Produtos afetados

Webspotblogging

Referências · 13

• 🔥 http://securityfocus.com/bid/16319 · Exploit
• 🔥 http://evuln.com/vulns/41/summary.html · Exploit
• 🔥 https://exploit-db.com/exploits/27114 · Exploit
• http://securityfocus.com/archive/1/422364/100/0/threaded · Nota
• http://securitytracker.com/id?1015522 · Nota
• https://sourceforge.net/project/shownotes.php?release_id=387180&group_id=156586 · Nota
• http://securityreason.com/securityalert/356 · Nota
• http://osvdb.org/22670 · Nota
• https://sourceforge.net/forum/forum.php?forum_id=532233 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0324 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24222 · Nota
• http://vupen.com/english/advisories/2006/0268 · Nota
• http://secunia.com/advisories/18560 · Nota