PT-2006-2050 · Smblog · Smartblog

Published 2006-03-07 · Updated 2018-10-18 · CVE-2006-1013

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SMartBlog (aka SMBlog) version 1.2

Description The issue allows remote attackers to include and execute arbitrary PHP files. This can be achieved via the pg parameter or a query string without a parameter.

Recommendations For SMartBlog (aka SMBlog) version 1.2, consider restricting access to the index.php file to minimize the risk of exploitation. As a temporary workaround, avoid using the pg parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-1013

Affected Products

Smartblog

References · 5

• 🔥 https://exploit-db.com/exploits/27340 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-1013 · Security Note
• http://securityfocus.com/archive/1/426498/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25220 · Note
• http://securityfocus.com/bid/16905 · Note