PT-2009-6487 · Scriptsez · Scriptsez Ez Blog

Published 2009-12-21 · Updated 2017-08-17 · CVE-2009-4365

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ScriptsEz Ez Blog version 1.0

Description The issue affects the admin.php script, allowing remote attackers to exploit multiple cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities enable attackers to hijack the authentication of administrators for various actions, including adding a blog via the "add blog" action, approving a comment via the "approve comment" action, changing administrator information (including the password) via the "admin opt" action, and deleting a blog via the "delete" action.

Recommendations For ScriptsEz Ez Blog version 1.0, as a temporary workaround, consider disabling the admin.php script until a patch is available. Restrict access to the admin.php script to minimize the risk of exploitation. Avoid using the actions add blog, approve comment, admin opt, and delete in the admin.php script until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2009-4365

Affected Products

Scriptsez Ez Blog

References · 7

• 🔥 https://exploit-db.com/exploits/10458 · Exploit
• 🔥 https://exploit-db.com/exploits/10461 · Exploit
• 🔥 http://packetstormsecurity.org/0912-exploits/ezblog-xssxsrf.txt · Exploit
• http://secunia.com/advisories/37743 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4365 · Security Note
• http://osvdb.org/61114 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54895 · Note