PT-2009-2274 · Mic Blog · Mic Blog

Staker · Published 2009-05-11 · Updated 2017-09-29 · CVE-2008-6805

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Mic Blog version 0.0.3

Description: The issue allows remote attackers to execute arbitrary SQL commands due to multiple SQL injection vulnerabilities. This can occur when the magic quotes gpc setting is disabled, specifically through the cat parameter to "category.php", the user parameter to "login.php", and the site parameter to "register.php".

Recommendations: For Mic Blog version 0.0.3, consider disabling the category.php, login.php, and register.php scripts until a patch is available, or ensure that the magic quotes gpc setting is enabled to mitigate the risk of SQL injection attacks. Additionally, restrict access to the cat, user, and site parameters in their respective scripts to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-6805

Affected Products

Mic Blog

References · 8

• 🔥 http://securityfocus.com/bid/31787 · Exploit
• 🔥 https://exploit-db.com/exploits/6764 · Exploit
• http://secunia.com/advisories/32310 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-6805 · Security Note
• http://osvdb.org/49186 · Note
• http://osvdb.org/49187 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45932 · Note
• http://osvdb.org/49188 · Note