PT-2009-4955 · Unknown · Super Simple Blog Script

Jiko · Publicado 2009-07-20 · Atualizado 2017-09-19 · CVE-2009-2553

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Super Simple Blog Script version 2.5.4

Description The issue concerns SQL injection vulnerabilities in the comments.php file of the Super Simple Blog Script. When magic quotes gpc is disabled, remote attackers can execute arbitrary SQL commands via the entry parameter.

Recommendations For Super Simple Blog Script version 2.5.4, consider disabling the comments.php file or restricting access to it until a patch is available. As a temporary workaround, enable magic quotes gpc to minimize the risk of SQL injection attacks.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-2553

Produtos afetados

Super Simple Blog Script

Referências · 5

• 🔥 http://exploit-db.com/exploits/9180 · Exploit
• 🔥 https://exploit-db.com/exploits/9180 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-2553 · Nota de Segurança
• http://secunia.com/advisories/35859 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51806 · Nota