PT-2009-6487 · Scriptsez · Scriptsez Ez Blog

Publicado 2009-12-21 · Atualizado 2017-08-17 · CVE-2009-4365

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ScriptsEz Ez Blog version 1.0

Description The issue affects the admin.php script, allowing remote attackers to exploit multiple cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities enable attackers to hijack the authentication of administrators for various actions, including adding a blog via the "add blog" action, approving a comment via the "approve comment" action, changing administrator information (including the password) via the "admin opt" action, and deleting a blog via the "delete" action.

Recommendations For ScriptsEz Ez Blog version 1.0, as a temporary workaround, consider disabling the admin.php script until a patch is available. Restrict access to the admin.php script to minimize the risk of exploitation. Avoid using the actions add blog, approve comment, admin opt, and delete in the admin.php script until the issue is resolved.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2009-4365

Produtos afetados

Scriptsez Ez Blog

Referências · 7

• 🔥 https://exploit-db.com/exploits/10458 · Exploit
• 🔥 https://exploit-db.com/exploits/10461 · Exploit
• 🔥 http://packetstormsecurity.org/0912-exploits/ezblog-xssxsrf.txt · Exploit
• http://secunia.com/advisories/37743 · Aviso do Fabricante
• http://osvdb.org/61114 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54895 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-4365 · Nota de Segurança