PT-2008-4709 · Bilboblog · Bilboblog

Black_H · Published 2008-07-25 · Updated 2017-09-29 · CVE-2008-3303

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: BilboBlog version 0.2.1

Description: The issue allows remote attackers to bypass authentication and obtain administrative access. This is achieved by making a direct request to the admin/login.php endpoint and setting the login, admin login, password, and admin passwd parameters when register globals is enabled.

Recommendations: For BilboBlog version 0.2.1, consider disabling the register globals setting to prevent exploitation. Additionally, restrict access to the admin/login.php endpoint until a more permanent solution is available. Avoid using the login, admin login, password, and admin passwd parameters in the affected endpoint until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-3303

Affected Products

Bilboblog

References · 6

• 🔥 https://exploit-db.com/exploits/6073 · Exploit
• http://secunia.com/advisories/31054 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3303 · Security Note
• http://securityfocus.com/bid/30225 · Note
• http://securityreason.com/securityalert/4036 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43762 · Note