PT-2009-4954 · Unknown · Super Simple Blog Script

Jiko · Publicado 2009-07-20 · Atualizado 2017-09-19 · CVE-2009-2552

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Super Simple Blog Script version 2.5.4

Description The issue concerns multiple directory traversal vulnerabilities in the comments.php file. Remote attackers can exploit these vulnerabilities to overwrite, include, and execute arbitrary local files by manipulating the entry parameter in the affected API endpoint.

Recommendations For Super Simple Blog Script version 2.5.4, consider restricting access to the comments.php file and the entry parameter to minimize the risk of exploitation. As a temporary workaround, avoid using the entry parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2009-2552

Produtos afetados

Super Simple Blog Script

Referências · 5

• 🔥 https://exploit-db.com/exploits/9179 · Exploit
• 🔥 http://exploit-db.com/exploits/9179 · Exploit
• http://secunia.com/advisories/35859 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-2552 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51805 · Nota