PT-2008-2185 · Nilson · Nilson'S Blogger

Muuratsalo · Published 2008-02-04 · Updated 2018-10-15 · CVE-2008-0559

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nilson's Blogger version 0.11

Description The issue allows remote attackers to include and execute arbitrary local files via directory traversal vulnerabilities. This can be achieved by using a .. (dot dot) in the permalink parameter in core.php, accessed through index.php, and the thispost parameter in comments.php.

Recommendations For Nilson's Blogger version 0.11, as a temporary workaround, consider restricting access to the core.php and comments.php files until a patch is available. Avoid using the permalink and thispost parameters in the affected API endpoints until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-0559

Affected Products

Nilson'S Blogger

References · 6

• 🔥 http://securityfocus.com/bid/27559 · Exploit
• 🔥 https://exploit-db.com/exploits/31083 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0559 · Security Note
• http://secunia.com/advisories/28737 · Vendor Advisory
• http://securityfocus.com/archive/1/487384/100/0/threaded · Note
• http://securityreason.com/securityalert/3604 · Note