PT-2007-2839 · Bp · Bp Blog

Beyazkurt · Published 2007-03-14 · Updated 2017-10-19 · CVE-2007-1445

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BP Blog versions 7.0 through 7.0.2

Description The issue concerns a SQL injection vulnerability in the theme preview feature of the default.asp file. This vulnerability allows remote attackers to execute arbitrary SQL commands by manipulating the layout parameter in the API endpoint.

Recommendations For BP Blog versions 7.0 through 7.0.2, consider restricting access to the theme preview feature until a patch is available. As a temporary workaround, avoid using the layout parameter in the default.asp file to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2007-1445

Affected Products

Bp Blog

References · 6

• 🔥 https://exploit-db.com/exploits/3466 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1445 · Security Note
• http://blog.betaparticle.com/template_permalink.asp?id=134 · Patch
• http://secunia.com/advisories/24473 · Vendor Advisory
• http://osvdb.org/33997 · Note
• http://vupen.com/english/advisories/2007/0919 · Note