PT-2005-4269 · Simple Php Blog · Simple Php Blog

Nenad Jovanovic · Published 2005-11-03 · Updated 2018-10-19 · CVE-2005-3473

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Simple PHP Blog versions 0.4.5 and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters in certain PHP files. This is achieved through the entry, blog subject, and blog text parameters, which involve the temp subject variable in preview cgi.php and preview static cgi.php files. Additionally, the scheme name and bg color parameters, involving the preset name and result variables in colors.php, are also vulnerable.

Recommendations For Simple PHP Blog versions 0.4.5 and earlier, consider disabling the preview cgi.php and preview static cgi.php files, as well as restricting access to the colors.php file until a patch is available. Avoid using the entry, blog subject, blog text, scheme name, and bg color parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2005-3473

Affected Products

Simple Php Blog

References · 12

• 🔥 https://exploit-db.com/exploits/26461 · Exploit
• 🔥 https://exploit-db.com/exploits/26463 · Exploit
• 🔥 https://exploit-db.com/exploits/26462 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-3473 · Security Note
• http://seclab.tuwien.ac.at/advisories/TUVSA-0511-001.txt · Vendor Advisory
• http://osvdb.org/20436 · Note
• http://osvdb.org/20438 · Note
• http://securityfocus.com/bid/15283 · Note
• http://securityfocus.com/archive/1/415463 · Note
• http://securityreason.com/securityalert/138 · Note
• http://osvdb.org/20437 · Note
• http://secunia.com/advisories/17404 · Note