PT-2005-4913 · Mybloggie · Mybloggie

Published 2005-12-14 · Updated 2018-10-19 · CVE-2005-4225

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions myBloggie version 2.1.3 beta

Description The issue allows remote attackers to execute arbitrary SQL commands via multiple parameters in various PHP files, including category in "add.php", cat desc in "addcat.php", level and user in "adduser.php", post id in "del.php", cat id in "delcat.php", comment id in "delcomment.php", id in "deluser.php", post id and category in "edit.php", cat id and cat desc in "editcat.php", and id, level, and user in "edituser.php".

Recommendations For myBloggie version 2.1.3 beta, consider temporarily restricting access to the vulnerable parameters, such as category, cat desc, level, user, post id, cat id, comment id, and id, in the respective PHP files until a patch is available. Avoid using these parameters in the affected API endpoints until the issue is resolved.

Fix

Related Identifiers

CVE-2005-4225

Affected Products

Mybloggie

References · 18

• http://secunia.com/advisories/18024 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-4225 · Security Note
• http://osvdb.org/21667 · Note
• http://osvdb.org/21670 · Note
• http://osvdb.org/21664 · Note
• http://osvdb.org/21669 · Note
• http://osvdb.org/21662 · Note
• http://glide.stanford.edu/yichen/research/sec.pdf · Note
• http://vupen.com/english/advisories/2005/2862 · Note
• http://osvdb.org/21666 · Note
• http://securityfocus.com/archive/1/419280/100/0/threaded · Note
• http://securityfocus.com/archive/1/419487/100/0/threaded · Note
• http://osvdb.org/21665 · Note
• http://osvdb.org/21659 · Note
• http://osvdb.org/21661 · Note