PT-2006-6679 · Sphpblog · Simple Php Blog

The_3Dit0R · Publicado 2006-11-21 · Atualizado 2018-10-17 · CVE-2006-6032

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Simple PHP Blog (SPHPBlog) versions prior to 0.4.9

Description The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters in certain PHP files. This can be achieved through the action parameter in "add block.php" or the entry parameter in "index.php".

Recommendations For Simple PHP Blog (SPHPBlog) versions prior to 0.4.9, update to version 0.4.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the "add block.php" and "index.php" files to minimize the risk of exploitation. Avoid using the action and entry parameters in the affected API endpoints until the issue is resolved.

Correção

Identificadores relacionados

CVE-2006-6032

Produtos afetados

Simple Php Blog

Referências · 4

• http://securityfocus.com/archive/1/451855/100/0/threaded · Nota
• http://securityreason.com/securityalert/1896 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30362 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6032 · Nota de Segurança