PT-2019-18721 · Nibbleblog · Nibbleblog

Publicado 2019-02-11 · Atualizado 2019-02-11 · CVE-2019-7719

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nibbleblog version 4.0.5

Description The issue allows for eval injection by placing PHP code in the username parameter of the install.php file, and then making a request to the "content/private/shadow.php" endpoint.

Recommendations For Nibbleblog version 4.0.5, avoid using the username parameter in the install.php file until the issue is resolved. As a temporary workaround, consider restricting access to the install.php file and the "content/private/shadow.php" endpoint to minimize the risk of exploitation.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2019-7719

Produtos afetados

Nibbleblog

Referências · 3

• 🔥 https://github.com/dignajar/nibbleblog/issues/138 · Exploit
• https://osv.dev/vulnerability/CVE-2019-7719 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-7719 · Nota de Segurança