PT-2010-2803 · Oi · Oi.Blogs

Published 2010-03-23 · Updated 2010-03-24 · CVE-2010-1082

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OI.Blogs version 1.0.0

Description The issue allows remote attackers to read arbitrary files due to multiple directory traversal vulnerabilities. This occurs when the magic quotes gpc setting is disabled. The vulnerabilities are exploited through directory traversal sequences in the theme parameter to "loadStyles.php" and the scripts parameter to "javascript/loadScripts.php".

Recommendations For OI.Blogs version 1.0.0, consider disabling the loadStyles.php and javascript/loadScripts.php scripts until a patch is available, or enable the magic quotes gpc setting to prevent exploitation. Additionally, restrict access to the theme and scripts parameters to minimize the risk of arbitrary file reading.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2010-1082

Affected Products

Oi.Blogs

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2010-1082 · Security Note
• http://secunia.com/advisories/38726 · Vendor Advisory