PT-2006-6679 · Sphpblog · Simple Php Blog

The_3Dit0R · Published 2006-11-21 · Updated 2018-10-17 · CVE-2006-6032

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Simple PHP Blog (SPHPBlog) versions prior to 0.4.9

Description The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters in certain PHP files. This can be achieved through the action parameter in "add block.php" or the entry parameter in "index.php".

Recommendations For Simple PHP Blog (SPHPBlog) versions prior to 0.4.9, update to version 0.4.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the "add block.php" and "index.php" files to minimize the risk of exploitation. Avoid using the action and entry parameters in the affected API endpoints until the issue is resolved.

Fix

Related Identifiers

CVE-2006-6032

Affected Products

Simple Php Blog

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2006-6032 · Security Note
• http://securityfocus.com/archive/1/451855/100/0/threaded · Note
• http://securityreason.com/securityalert/1896 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30362 · Note