PT-2005-3906 · Simplog · Simplog

Mustafa Can Bjorn Ipekci + 1 · Published 2005-09-27 · Updated 2008-09-05 · CVE-2005-3076

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Simplog version 0.9.1

Description The issue allows remote attackers to execute arbitrary SQL commands or trigger SQL error messages. This can be achieved by providing invalid parameters to specific API endpoints, including pid, blogid, cid, or m parameters to "archive.php", or the blogid parameter to "blogadmin.php".

Recommendations For Simplog version 0.9.1, as a temporary workaround, consider validating and sanitizing the pid, blogid, cid, m, and blogid parameters in the "archive.php" and "blogadmin.php" files to prevent SQL injection attacks. Restrict access to these endpoints until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-3076

Affected Products

Simplog

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2005-3076 · Security Note
• http://simplog.org/bugs/bug.php?op=show&bugid=55 · Note
• http://secunia.com/advisories/16881 · Note
• http://securityfocus.com/bid/14897 · Note
• http://securityreason.com/securityalert/755 · Note