PT-2006-2050 · Smblog · Smartblog

Publicado 2006-03-07 · Atualizado 2018-10-18 · CVE-2006-1013

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SMartBlog (aka SMBlog) version 1.2

Description The issue allows remote attackers to include and execute arbitrary PHP files. This can be achieved via the pg parameter or a query string without a parameter.

Recommendations For SMartBlog (aka SMBlog) version 1.2, consider restricting access to the index.php file to minimize the risk of exploitation. As a temporary workaround, avoid using the pg parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-1013

Produtos afetados

Smartblog

Referências · 5

• 🔥 https://exploit-db.com/exploits/27340 · Exploit
• http://securityfocus.com/archive/1/426498/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25220 · Nota
• http://securityfocus.com/bid/16905 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-1013 · Nota de Segurança