20091218 [ISecAuditors Security Advisories] Simple PHP Blog <= 0.5.1 Local File Include vulnerabilitymailing list
http://archives.neohapsis.com/archives/fulldisclosure/2009-12/0398.html CVE-2009-4421
Simple PHP Blog 0.5.1 - Local File Inclusion
Record summary
CVE-2009-4421 has a selected CVSS score of 6.5; EIP currently links 1 catalogued exploit.
Description
Directory traversal vulnerability in languages_cgi.php in Simple PHP Blog 0.5.1 and earlier allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the blog_language1 parameter.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBSimple PHP Blog 0.5.1 - Local File InclusionExploitDB exploitby jgalianaNot analyzed1 file
References
520091218 [ISecAuditors Security Advisories] Simple PHP Blog <= 0.5.1 Local File Include vulnerabilitymailing list
http://www.securityfocus.com/archive/1/508546/100/0/threaded 37434vdb entry
http://www.securityfocus.com/bid/37434 spb-bloblanguage1-file-include(54970)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/54970 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2009-4421