PT-2007-5253 · Bitdamaged · Geoblog

Published 2007-07-27 · Updated 2018-10-15 · CVE-2007-4047

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions: geoBlog (aka BitDamaged) version 1

Description: The issue allows remote attackers to delete arbitrary comments and blogs without authentication. This is possible due to the lack of authentication requirements for certain API endpoints, specifically deletecomment.php, deleteblog.php, and listcomment.php in the admin/ directory. Attackers can exploit this by sending a request with a valid id parameter to these endpoints, potentially having other unspecified impacts.

Recommendations: For geoBlog (aka BitDamaged) version 1, consider implementing proper authentication mechanisms for the deletecomment.php, deleteblog.php, and listcomment.php endpoints in the admin/ directory to prevent unauthorized access. As a temporary workaround, restrict access to these endpoints to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2007-4047

Affected Products

Geoblog

References · 10

• 🔥 http://securityfocus.com/bid/24966 · Exploit
• 🔥 https://exploit-db.com/exploits/30320 · Exploit
• 🔥 https://exploit-db.com/exploits/30321 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-4047 · Security Note
• http://securityfocus.com/archive/1/474127/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35494 · Note
• http://osvdb.org/42487 · Note
• http://osvdb.org/42485 · Note
• http://osvdb.org/42486 · Note
• http://securityreason.com/securityalert/2934 · Note