PT-2005-1882 · Betaparticle · Betaparticle Blog

Published 2005-03-24 · Updated 2017-07-11 · CVE-2005-0854

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions betaparticle blog (bp blog) versions prior to 4

Description The issue allows remote attackers to bypass authentication. This can lead to two main consequences: (1) uploading files via a direct request to "upload.asp" (2) deleting files via a direct request to "myFiles.asp".

Recommendations For versions prior to 4, as a temporary workaround, consider restricting access to the "upload.asp" and "myFiles.asp" endpoints until a patch is available. Avoid using these endpoints in your workflow until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2005-0854

Affected Products

Betaparticle Blog

References · 8

• 🔥 https://exploit-db.com/exploits/25253 · Exploit
• 🔥 http://securityfocus.com/bid/12861 · Exploit
• 🔥 https://exploit-db.com/exploits/25254 · Exploit
• http://secunia.com/advisories/14668 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0854 · Security Note
• http://seclists.org/lists/bugtraq/2005/Mar/0360.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19781 · Note
• http://blog.betaparticle.com/template_permalink.asp?id=68 · Note