PT-2007-6174 · Simple Php Blog · Simple Php Blog

Published 2007-09-24 · Updated 2018-10-15 · CVE-2007-5071

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Simple PHP Blog versions prior to 0.5.1

Description The issue allows remote attackers to upload dangerous files and execute arbitrary code. This can be achieved by uploading a file with a filename ending in .php or a .htaccess file.

Recommendations For versions prior to 0.5.1, update to version 0.5.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the upload img cgi.php file to minimize the risk of exploitation. Avoid using the upload functionality in the affected version until the issue is resolved.

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2007-5071

Affected Products

Simple Php Blog

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2007-5071 · Security Note
• http://secunia.com/advisories/26968 · Note
• http://simplephpblog.com/index.php?m=09&y=07 · Note
• http://securityfocus.com/archive/1/480569/100/0/threaded · Note
• http://securenetwork.it/ricerca/advisory/download/SN-2007-03.txt · Note
• http://securityfocus.com/archive/1/480092/100/0/threaded · Note
• http://simplephpblog.com/comments.php?y=07&m=09&entry=entry070923-004446 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36785 · Note
• http://securityfocus.com/bid/25747 · Note