PT-2008-4939 · Plogger · Plogger

James Bercegay · Publicado 2008-08-10 · Atualizado 2018-10-11 · CVE-2008-3563

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Plogger versions 3.0 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands, potentially leading to data manipulation or extraction. This can be achieved through the checked array parameter to "plog-download.php" in an album action, and unspecified parameters to "plog-remote.php". Additionally, remote authenticated administrators can execute arbitrary SQL commands via the activate parameter to "admin/plog-themes.php", related to theme dir settings.

Recommendations For Plogger versions 3.0 and earlier, update to a version later than 3.0 to resolve the issue. As a temporary workaround, consider restricting access to the "plog-download.php" and "plog-remote.php" scripts, and limiting administrative access to "admin/plog-themes.php" until a patch is available. Avoid using the activate parameter in "admin/plog-themes.php" and the checked array parameter in "plog-download.php" until the issue is resolved.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-3563

Produtos afetados

Plogger

Referências · 9

• 🔥 https://exploit-db.com/exploits/6204 · Exploit
• http://securityreason.com/securityalert/4121 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3563 · Nota
• http://dev.plogger.org/changeset/569 · Nota
• http://securityfocus.com/archive/1/495116/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44233 · Nota
• http://securityfocus.com/bid/30547 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-3563 · Nota de Segurança
• http://gulftech.org/?node=research&article_id=00121-08042008 · Nota