PT-2006-5523 · F Art · F-Art Blog:Cms

Omid · Published 2006-09-13 · Updated 2018-10-17 · CVE-2006-4748

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions F-ART BLOG:CMS version 4.1

Description The issue allows remote attackers to execute arbitrary SQL commands via the xagent, xpath, xreferer, and xdns parameters in admin/plugins/NP Log.php, and the pitem parameter in admin/plugins/NP Poll.php. Additionally, remote authenticated users can execute arbitrary SQL commands via the pageRef parameter in admin/plugins/NP Referrer.php.

Recommendations For F-ART BLOG:CMS version 4.1, consider disabling the NP Log.php, NP Poll.php, and NP Referrer.php plugins until a patch is available. Restrict access to the xagent, xpath, xreferer, xdns, pitem, and pageRef parameters to minimize the risk of exploitation. Avoid using these parameters in the affected API endpoints until the issue is resolved.

Fix

Related Identifiers

CVE-2006-4748

Affected Products

F-Art Blog:Cms

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2006-4748 · Security Note
• http://osvdb.org/28606 · Note
• http://osvdb.org/28605 · Note
• http://securityreason.com/securityalert/1566 · Note
• http://vupen.com/english/advisories/2006/3521 · Note
• http://secunia.com/advisories/21808 · Note
• http://securityfocus.com/archive/1/445538/100/0/threaded · Note
• http://osvdb.org/28604 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28808 · Note
• http://securityfocus.com/bid/19909 · Note
• http://hackers.ir/advisories/blogcms.html · Note
• http://blogcms.com/wiki/changelog · Note