PT-2018-18248 · Z Blogphp · Z-Blogphp

Zzw · Published 2018-03-06 · Updated 2024-08-05 · CVE-2018-7737

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Z-BlogPHP version 1.5.1.1740

Description: There is a potential issue in Z-BlogPHP where the physical path of the web site may be leaked, as demonstrated by accessing certain files such as admin footer.php. However, it's noted that the software maintainer disputes this being classified as a vulnerability.

Recommendations: For Z-BlogPHP version 1.5.1.1740, consider restricting access to sensitive files like admin footer.php to minimize potential information disclosure. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-7737

Affected Products

Z-Blogphp

References · 6

• 🔥 https://exploit-db.com/exploits/44407 · Exploit
• 🔥 https://packetstormsecurity.com/files/147063/Z-Blog-1.5.1.1740-Full-Path-Disclosure.html · Exploit
• https://osv.dev/vulnerability/CVE-2018-7737 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-7737 · Security Note
• https://github.com/zblogcn/zblogphp/issues/205 · Note
• ❌ https://github.com/ponyma233/cms/blob/master/Z-Blog_1.5.1.1740_bugs.md#web-site-physical-path-leakage · Note, Deleted