PT-2005-2496 · Mybloggie · Mybloggie

Alberto Trivero + 1 · Published 2005-05-11 · Updated 2017-07-11 · CVE-2005-1500

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions myBloggie versions 2.1.1 through 2.1.3

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters in different modes, including the keyword parameter in "search.php", the date no parameter in viewdate mode, the cat id parameter in viewcat mode, the month no or year parameter in viewmonth mode, or the post id parameter in viewid mode to "index.php".

Recommendations For myBloggie versions 2.1.1 through 2.1.3, consider restricting access to the vulnerable parameters keyword, date no, cat id, month no, year, and post id in their respective modes until a patch is available. As a temporary workaround, avoid using these parameters in the affected API endpoints. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2005-1500

Affected Products

Mybloggie

References · 9

• 🔥 http://mywebland.com/forums/viewtopic.php?t=180 · Exploit
• 🔥 https://exploit-db.com/exploits/1023 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-1500 · Security Note
• http://secunia.com/advisories/14980 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/20439 · Note
• http://marc.info/?l=bugtraq&m=111722848308367&w=2 · Note
• http://securityfocus.com/bid/13507 · Note
• http://marc.info/?l=bugtraq&m=111531904608224&w=2 · Note
• http://securityfocus.com/bid/15017 · Note