PT-2007-4474 · Mybloggie · Mybloggie

Published 2007-06-12 · Updated 2025-01-17 · CVE-2007-3194

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: myBloggie version 2.1.5

Description: The issue allows remote attackers to potentially execute arbitrary PHP code via a URL in the bloggie root path parameter to several PHP files, including config.php, db.php, template.php, functions.php, classes.php, viewmode.php, and blog body.php. However, it is noted that another researcher disputes this vulnerability, citing that the files are protected against direct requests, contain no relevant include statements, or do not exist.

Recommendations: For myBloggie version 2.1.5, consider restricting access to the bloggie root path parameter to minimize the risk of exploitation. Additionally, review the include statements and protections in place for the mentioned PHP files to ensure they are secure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-3194

Affected Products

Mybloggie

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-3194 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2007-06/0125.html · Note
• http://osvdb.org/37685 · Note
• http://securityreason.com/securityalert/2794 · Note
• http://securityfocus.com/archive/1/470972/100/0/threaded · Note