PT-2008-2185 · Nilson · Nilson'S Blogger

Muuratsalo · Publicado 2008-02-04 · Atualizado 2018-10-15 · CVE-2008-0559

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nilson's Blogger version 0.11

Description The issue allows remote attackers to include and execute arbitrary local files via directory traversal vulnerabilities. This can be achieved by using a .. (dot dot) in the permalink parameter in core.php, accessed through index.php, and the thispost parameter in comments.php.

Recommendations For Nilson's Blogger version 0.11, as a temporary workaround, consider restricting access to the core.php and comments.php files until a patch is available. Avoid using the permalink and thispost parameters in the affected API endpoints until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-0559

Produtos afetados

Nilson'S Blogger

Referências · 6

• 🔥 http://securityfocus.com/bid/27559 · Exploit
• 🔥 https://exploit-db.com/exploits/31083 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0559 · Nota de Segurança
• http://secunia.com/advisories/28737 · Aviso do Fabricante
• http://securityfocus.com/archive/1/487384/100/0/threaded · Nota
• http://securityreason.com/securityalert/3604 · Nota