PT-2009-4955 · Unknown · Super Simple Blog Script

Jiko · Published 2009-07-20 · Updated 2017-09-19 · CVE-2009-2553

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Super Simple Blog Script version 2.5.4

Description The issue concerns SQL injection vulnerabilities in the comments.php file of the Super Simple Blog Script. When magic quotes gpc is disabled, remote attackers can execute arbitrary SQL commands via the entry parameter.

Recommendations For Super Simple Blog Script version 2.5.4, consider disabling the comments.php file or restricting access to it until a patch is available. As a temporary workaround, enable magic quotes gpc to minimize the risk of SQL injection attacks.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-2553

Affected Products

Super Simple Blog Script

References · 5

• 🔥 http://exploit-db.com/exploits/9180 · Exploit
• 🔥 https://exploit-db.com/exploits/9180 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-2553 · Security Note
• http://secunia.com/advisories/35859 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51806 · Note