PT-2009-3620 · Yap · Yap Blog

Sirgod · Published 2009-03-20 · Updated 2017-09-29 · CVE-2009-1038

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions YAP Blog version 1.1.1

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the image id parameter to "comments.php" or, for remote authenticated administrators, via the user parameter in a "modif" action to "admin/index.php".

Recommendations For YAP Blog version 1.1.1, consider restricting access to the "comments.php" and "admin/index.php" files until a patch is available. As a temporary workaround, avoid using the image id parameter in the "comments.php" file and the user parameter in the "modif" action to "admin/index.php" to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-1038

Affected Products

Yap Blog

References · 6

• 🔥 http://osvdb.org/52761 · Exploit
• 🔥 https://exploit-db.com/exploits/8217 · Exploit
• 🔥 https://exploit-db.com/exploits/8207 · Exploit
• 🔥 http://osvdb.org/52762 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-1038 · Security Note
• http://securityfocus.com/bid/34274 · Note