PT-2009-1943 · Blogator · Blogator-Script

Publicado 2009-03-16 · Atualizado 2018-10-11 · CVE-2008-6473

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Blogator-script version 0.95

Description The issue allows remote attackers to change the password for arbitrary users. This is achieved by modifying the a parameter and using a % wildcard symbol in the b parameter in the blogadata/include/init pass2.php file.

Recommendations For Blogator-script version 0.95, consider restricting access to the blogadata/include/init pass2.php file until a patch is available. As a temporary workaround, avoid using the % wildcard symbol in the b parameter to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2008-6473

Produtos afetados

Blogator-Script

Referências · 4

• 🔥 https://exploit-db.com/exploits/5370 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-6473 · Nota de Segurança
• http://securityfocus.com/archive/1/490501/100/0/threaded · Nota
• http://osvdb.org/51227 · Nota