PT-2009-3620 · Yap · Yap Blog

Sirgod · Publicado 2009-03-20 · Atualizado 2017-09-29 · CVE-2009-1038

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions YAP Blog version 1.1.1

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the image id parameter to "comments.php" or, for remote authenticated administrators, via the user parameter in a "modif" action to "admin/index.php".

Recommendations For YAP Blog version 1.1.1, consider restricting access to the "comments.php" and "admin/index.php" files until a patch is available. As a temporary workaround, avoid using the image id parameter in the "comments.php" file and the user parameter in the "modif" action to "admin/index.php" to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-1038

Produtos afetados

Yap Blog

Referências · 6

• 🔥 http://osvdb.org/52761 · Exploit
• 🔥 https://exploit-db.com/exploits/8217 · Exploit
• 🔥 https://exploit-db.com/exploits/8207 · Exploit
• 🔥 http://osvdb.org/52762 · Exploit
• http://securityfocus.com/bid/34274 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-1038 · Nota de Segurança