PT-2005-4784 · Unknown · Blog System

Vipsta · Published 2005-12-07 · Updated 2018-10-19 · CVE-2005-4049

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Blog System version 1.2

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via two parameters: the cat parameter in "index.php" and the note parameter in "blog.php".

Recommendations For Blog System version 1.2, consider restricting access to the cat parameter in "index.php" and the note parameter in "blog.php" to minimize the risk of exploitation. Avoid using these parameters until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2005-4049

Affected Products

Blog System

References · 12

• 🔥 https://exploit-db.com/exploits/26731 · Exploit
• 🔥 http://securitytracker.com/id?1015310 · Exploit
• 🔥 http://securityfocus.com/bid/15719 · Exploit
• http://secunia.com/advisories/17893 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-4049 · Security Note
• http://osvdb.org/21453 · Note
• http://vupen.com/english/advisories/2005/2767 · Note
• http://pridels0.blogspot.com/2005/12/blog-system-v12-sql-inj-vuln.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23430 · Note
• http://securityfocus.com/archive/1/418640/100/0/threaded · Note
• http://osvdb.org/21454 · Note
• http://securityreason.com/securityalert/230 · Note