PT-2006-2782 · Quickblogger · Quickblogger

Publicado 2006-04-14 · Atualizado 2018-10-18 · CVE-2006-1791

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions QuickBlogger version 1.4

Description A directory traversal issue in the acc.php file allows remote attackers to read or include arbitrary local files via the request parameter. This issue can also lead to resultant XSS when the associated include statement fails.

Recommendations For QuickBlogger version 1.4, consider restricting access to the acc.php file and the request parameter to minimize the risk of exploitation. As a temporary workaround, avoid using the request parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-1791

Produtos afetados

Quickblogger

Referências · 5

• 🔥 http://secunia.com/advisories/15942 · Exploit
• http://securityfocus.com/archive/1/430878/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-1791 · Nota de Segurança
• http://securityfocus.com/archive/1/431059/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25795 · Nota