PT-2005-2185 · Unknown · Mafia Blog

Dominus_Vis · Published 2005-04-18 · Updated 2016-10-18 · CVE-2005-1169

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mafia Blog version .4 BETA

Description The issue allows remote attackers to execute arbitrary PHP code. This is possible because the admin directory is not properly protected, enabling attackers to inject code into info.php using writeinfo.php.

Recommendations For Mafia Blog version .4 BETA, consider restricting access to the admin directory and the writeinfo.php file to prevent arbitrary PHP code execution until a proper fix is available.

Fix

Related Identifiers

CVE-2005-1169

Affected Products

Mafia Blog

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2005-1169 · Security Note
• http://marc.info/?l=bugtraq&m=111359511826958&w=2 · Note
• http://securityfocus.com/bid/13194 · Note
• http://chrisnowak.org/projects/mafia · Note