PT-2014-8811 · Six Apart · Movable Type

Netanel Rubin · Publicado 2014-12-16 · Atualizado 2015-11-17 · CVE-2014-9057

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Movable Type versions prior to 5.18 Movable Type versions 5.2.x prior to 5.2.11 Movable Type versions 6.x prior to 6.0.6

Description A SQL injection issue exists in the XML-RPC interface, allowing remote attackers to execute arbitrary SQL commands.

Recommendations For Movable Type versions prior to 5.18, update to version 5.18 or later. For Movable Type versions 5.2.x prior to 5.2.11, update to version 5.2.11 or later. For Movable Type versions 6.x prior to 6.0.6, update to version 6.0.6 or later.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2014-9057

DSA-3183-1

Produtos afetados

Movable Type

Referências · 15

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/sixapart_movabletype_storable_exec.rb · Exploit
• 🔥 https://github.com/lightsey/cve-2015-1592 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-9057 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1592 · Nota de Segurança
• http://secunia.com/advisories/61227 · Nota
• https://debian.org/security/2015/dsa-3183 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9057 · Nota de Segurança
• https://osv.dev/vulnerability/DSA-3183-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/DSA-3183-1 · Aviso do Fabricante
• https://packages.debian.org/src:movabletype-opensource · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9057 · Nota
• https://security-tracker.debian.org/tracker/source-package/movabletype-opensource · Aviso do Fabricante
• https://movabletype.org/documentation/appendices/release-notes/6.0.6.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2184 · Nota de Segurança
• https://movabletype.org/news/2014/12/6.0.6.html · Aviso do Fabricante