PT-2008-2257 · Lightblog · Lightblog

Omni · Published 2008-02-06 · Updated 2018-10-15 · CVE-2008-0632

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions LightBlog version 9.5

Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the blog's root directory via the cp upload image.php script, and then accessing it directly.

Recommendations For LightBlog version 9.5, consider restricting or disabling the cp upload image.php script until a patch is available to prevent remote attackers from uploading executable files. Additionally, restrict access to the blog's root directory to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-0632

Affected Products

Lightblog

References · 7

• 🔥 https://exploit-db.com/exploits/5033 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0632 · Security Note
• http://secunia.com/advisories/28734 · Vendor Advisory
• http://securityfocus.com/archive/1/487398/100/0/threaded · Note
• http://omni.netsons.org/blog/?p=11 · Note
• http://securityreason.com/securityalert/3617 · Note
• http://securityfocus.com/bid/27562 · Note