PT-2006-5523 · F Art · F-Art Blog:Cms

Omid · Publicado 2006-09-13 · Atualizado 2018-10-17 · CVE-2006-4748

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions F-ART BLOG:CMS version 4.1

Description The issue allows remote attackers to execute arbitrary SQL commands via the xagent, xpath, xreferer, and xdns parameters in admin/plugins/NP Log.php, and the pitem parameter in admin/plugins/NP Poll.php. Additionally, remote authenticated users can execute arbitrary SQL commands via the pageRef parameter in admin/plugins/NP Referrer.php.

Recommendations For F-ART BLOG:CMS version 4.1, consider disabling the NP Log.php, NP Poll.php, and NP Referrer.php plugins until a patch is available. Restrict access to the xagent, xpath, xreferer, xdns, pitem, and pageRef parameters to minimize the risk of exploitation. Avoid using these parameters in the affected API endpoints until the issue is resolved.

Correção

Identificadores relacionados

CVE-2006-4748

Produtos afetados

F-Art Blog:Cms

Referências · 12

• http://osvdb.org/28606 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-4748 · Nota de Segurança
• http://osvdb.org/28605 · Nota
• http://securityreason.com/securityalert/1566 · Nota
• http://vupen.com/english/advisories/2006/3521 · Nota
• http://secunia.com/advisories/21808 · Nota
• http://securityfocus.com/archive/1/445538/100/0/threaded · Nota
• http://osvdb.org/28604 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28808 · Nota
• http://securityfocus.com/bid/19909 · Nota
• http://hackers.ir/advisories/blogcms.html · Nota
• http://blogcms.com/wiki/changelog · Nota