PT-2009-2274 · Mic Blog · Mic Blog

Staker · Publicado 2009-05-11 · Atualizado 2017-09-29 · CVE-2008-6805

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Mic Blog version 0.0.3

Description: The issue allows remote attackers to execute arbitrary SQL commands due to multiple SQL injection vulnerabilities. This can occur when the magic quotes gpc setting is disabled, specifically through the cat parameter to "category.php", the user parameter to "login.php", and the site parameter to "register.php".

Recommendations: For Mic Blog version 0.0.3, consider disabling the category.php, login.php, and register.php scripts until a patch is available, or ensure that the magic quotes gpc setting is enabled to mitigate the risk of SQL injection attacks. Additionally, restrict access to the cat, user, and site parameters in their respective scripts to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-6805

Produtos afetados

Mic Blog

Referências · 8

• 🔥 http://securityfocus.com/bid/31787 · Exploit
• 🔥 https://exploit-db.com/exploits/6764 · Exploit
• http://secunia.com/advisories/32310 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-6805 · Nota de Segurança
• http://osvdb.org/49186 · Nota
• http://osvdb.org/49187 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45932 · Nota
• http://osvdb.org/49188 · Nota