PT-2006-2782 · Quickblogger · Quickblogger

Published 2006-04-14 · Updated 2018-10-18 · CVE-2006-1791

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions QuickBlogger version 1.4

Description A directory traversal issue in the acc.php file allows remote attackers to read or include arbitrary local files via the request parameter. This issue can also lead to resultant XSS when the associated include statement fails.

Recommendations For QuickBlogger version 1.4, consider restricting access to the acc.php file and the request parameter to minimize the risk of exploitation. As a temporary workaround, avoid using the request parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-1791

Affected Products

Quickblogger

References · 5

• 🔥 http://secunia.com/advisories/15942 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-1791 · Security Note
• http://securityfocus.com/archive/1/430878/100/0/threaded · Note
• http://securityfocus.com/archive/1/431059/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25795 · Note