PT-2007-2839 · Bp · Bp Blog

Beyazkurt · Publicado 2007-03-14 · Atualizado 2017-10-19 · CVE-2007-1445

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BP Blog versions 7.0 through 7.0.2

Description The issue concerns a SQL injection vulnerability in the theme preview feature of the default.asp file. This vulnerability allows remote attackers to execute arbitrary SQL commands by manipulating the layout parameter in the API endpoint.

Recommendations For BP Blog versions 7.0 through 7.0.2, consider restricting access to the theme preview feature until a patch is available. As a temporary workaround, avoid using the layout parameter in the default.asp file to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2007-1445

Produtos afetados

Bp Blog

Referências · 6

• 🔥 https://exploit-db.com/exploits/3466 · Exploit
• http://osvdb.org/33997 · Nota
• http://vupen.com/english/advisories/2007/0919 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1445 · Nota de Segurança
• http://blog.betaparticle.com/template_permalink.asp?id=134 · Correção
• http://secunia.com/advisories/24473 · Aviso do Fabricante