PT-2009-4954 · Unknown · Super Simple Blog Script

Jiko · Published 2009-07-20 · Updated 2017-09-19 · CVE-2009-2552

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Super Simple Blog Script version 2.5.4

Description The issue concerns multiple directory traversal vulnerabilities in the comments.php file. Remote attackers can exploit these vulnerabilities to overwrite, include, and execute arbitrary local files by manipulating the entry parameter in the affected API endpoint.

Recommendations For Super Simple Blog Script version 2.5.4, consider restricting access to the comments.php file and the entry parameter to minimize the risk of exploitation. As a temporary workaround, avoid using the entry parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2009-2552

Affected Products

Super Simple Blog Script

References · 5

• 🔥 https://exploit-db.com/exploits/9179 · Exploit
• 🔥 http://exploit-db.com/exploits/9179 · Exploit
• http://secunia.com/advisories/35859 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2552 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51805 · Note