PT-2005-2494 · Mybloggie · Mybloggie

Alberto Trivero + 1 · Published 2005-05-11 · Updated 2017-07-11 · CVE-2005-1498

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions myBloggie version 2.1.1

Description The issue allows remote attackers to inject arbitrary web script or HTML via several parameters in viewmode.php and index.php, which are not properly sanitized before being displayed in an error message. Specifically, the year parameter in viewmode.php and the cat id, month no, and post id parameters in index.php are vulnerable.

Recommendations For myBloggie version 2.1.1, consider disabling the vulnerable parameters year, cat id, month no, and post id in viewmode.php and index.php until a patch is available. Restrict access to the error messages that display these parameters to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-1498

Affected Products

Mybloggie

References · 7

• 🔥 https://exploit-db.com/exploits/25612 · Exploit
• 🔥 http://securityfocus.com/bid/13507 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-1498 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/20434 · Note
• http://marc.info/?l=bugtraq&m=111531904608224&w=2 · Note
• http://mywebland.com/forums/viewtopic.php?t=180 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/20436 · Note