PT-2009-3042 · Max · Max.Blog

Sirgod · Published 2009-02-02 · Updated 2024-02-14 · CVE-2009-0383

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Max.Blog version 1.0.6

Description The issue concerns improper access restriction in the delete.php file, allowing remote attackers to delete arbitrary blog posts by making a direct request.

Recommendations For Max.Blog version 1.0.6, restrict access to the delete.php file to prevent unauthorized deletion of blog posts. As a temporary workaround, consider disabling the delete functionality until a proper fix is implemented.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-0383

Affected Products

Max.Blog

References · 7

• 🔥 https://exploit-db.com/exploits/7835 · Exploit
• http://mzbservices.com/show_post.php?id=72 · Vendor Advisory
• http://secunia.com/advisories/33590 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0383 · Security Note
• http://securityfocus.com/bid/33368 · Note
• http://osvdb.org/51482 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48125 · Note