PT-2010-1614 · Ez-Blog · Ez-Blog

Drosophila + 1 · Publicado 2010-04-23 · Atualizado 2018-10-10 · CVE-2009-4805

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions EZ-Blog version Beta 1

Description The issue concerns SQL injection vulnerabilities. When magic quotes gpc is disabled, remote attackers can execute arbitrary SQL commands. This can be achieved via the storyid parameter to "public/view.php" or the kill parameter to "admin/remove.php".

Recommendations For EZ-Blog version Beta 1, consider disabling the storyid and kill parameters in the respective API endpoints "public/view.php" and "admin/remove.php" until a patch is available. Restrict access to these endpoints to minimize the risk of exploitation. Enable magic quotes gpc to prevent SQL injection attacks.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-4805

Produtos afetados

Ez-Blog

Referências · 6

• 🔥 https://exploit-db.com/exploits/8128 · Exploit
• 🔥 http://securityfocus.com/bid/33947 · Exploit
• 🔥 http://exploit-db.com/exploits/8128 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49013 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-4805 · Nota de Segurança
• http://securityfocus.com/archive/1/501352/100/0/threaded · Nota