PT-2008-4709 · Bilboblog · Bilboblog

Black_H · Publicado 2008-07-25 · Atualizado 2017-09-29 · CVE-2008-3303

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: BilboBlog version 0.2.1

Description: The issue allows remote attackers to bypass authentication and obtain administrative access. This is achieved by making a direct request to the admin/login.php endpoint and setting the login, admin login, password, and admin passwd parameters when register globals is enabled.

Recommendations: For BilboBlog version 0.2.1, consider disabling the register globals setting to prevent exploitation. Additionally, restrict access to the admin/login.php endpoint until a more permanent solution is available. Avoid using the login, admin login, password, and admin passwd parameters in the affected endpoint until the issue is resolved.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-3303

Produtos afetados

Bilboblog

Referências · 6

• 🔥 https://exploit-db.com/exploits/6073 · Exploit
• http://securityfocus.com/bid/30225 · Nota
• http://securityreason.com/securityalert/4036 · Nota
• http://secunia.com/advisories/31054 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-3303 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43762 · Nota