PT-2008-4939 · Plogger · Plogger

James Bercegay · Published 2008-08-10 · Updated 2018-10-11 · CVE-2008-3563

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Plogger versions 3.0 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands, potentially leading to data manipulation or extraction. This can be achieved through the checked array parameter to "plog-download.php" in an album action, and unspecified parameters to "plog-remote.php". Additionally, remote authenticated administrators can execute arbitrary SQL commands via the activate parameter to "admin/plog-themes.php", related to theme dir settings.

Recommendations For Plogger versions 3.0 and earlier, update to a version later than 3.0 to resolve the issue. As a temporary workaround, consider restricting access to the "plog-download.php" and "plog-remote.php" scripts, and limiting administrative access to "admin/plog-themes.php" until a patch is available. Avoid using the activate parameter in "admin/plog-themes.php" and the checked array parameter in "plog-download.php" until the issue is resolved.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-3563

Affected Products

Plogger

References · 9

• 🔥 https://exploit-db.com/exploits/6204 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-3563 · Security Note
• http://securityreason.com/securityalert/4121 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3563 · Note
• http://dev.plogger.org/changeset/569 · Note
• http://securityfocus.com/archive/1/495116/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44233 · Note
• http://securityfocus.com/bid/30547 · Note
• http://gulftech.org/?node=research&article_id=00121-08042008 · Note