PT-2007-5253 · Bitdamaged · Geoblog

Publicado 2007-07-27 · Atualizado 2018-10-15 · CVE-2007-4047

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions: geoBlog (aka BitDamaged) version 1

Description: The issue allows remote attackers to delete arbitrary comments and blogs without authentication. This is possible due to the lack of authentication requirements for certain API endpoints, specifically deletecomment.php, deleteblog.php, and listcomment.php in the admin/ directory. Attackers can exploit this by sending a request with a valid id parameter to these endpoints, potentially having other unspecified impacts.

Recommendations: For geoBlog (aka BitDamaged) version 1, consider implementing proper authentication mechanisms for the deletecomment.php, deleteblog.php, and listcomment.php endpoints in the admin/ directory to prevent unauthorized access. As a temporary workaround, restrict access to these endpoints to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2007-4047

Produtos afetados

Geoblog

Referências · 10

• 🔥 http://securityfocus.com/bid/24966 · Exploit
• 🔥 https://exploit-db.com/exploits/30320 · Exploit
• 🔥 https://exploit-db.com/exploits/30321 · Exploit
• http://securityfocus.com/archive/1/474127/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4047 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35494 · Nota
• http://osvdb.org/42487 · Nota
• http://osvdb.org/42485 · Nota
• http://osvdb.org/42486 · Nota
• http://securityreason.com/securityalert/2934 · Nota