geoBlog Multiple Security Bypass Vulnerabilities
BID:24966
Info
geoBlog Multiple Security Bypass Vulnerabilities
| Bugtraq ID: | 24966 |
| Class: | Input Validation Error |
| CVE: |
CVE-2007-4047 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 19 2007 12:00AM |
| Updated: | May 07 2015 05:36PM |
| Credit: | [email protected] is credited with discovering these issues. |
| Vulnerable: |
geoBLog geoBlog MOD_1.0 |
| Not Vulnerable: | |
Discussion
geoBlog Multiple Security Bypass Vulnerabilities
geoBlog is prone to multiple security-bypass vulnerabilities because the application fails to properly validate users when deleting user blogs and comments.
An attacker may exploit these issues to delete blogs and comments regardless of the security settings. This may aid the attacker in further attacks.
geoBlog v1 is vulnerable to these issues.
geoBlog is prone to multiple security-bypass vulnerabilities because the application fails to properly validate users when deleting user blogs and comments.
An attacker may exploit these issues to delete blogs and comments regardless of the security settings. This may aid the attacker in further attacks.
geoBlog v1 is vulnerable to these issues.
Exploit / POC
geoBlog Multiple Security Bypass Vulnerabilities
An attacker may exploit these issues using a browser.
Sample exploit URIs have been provided:
http://www.example.com/blog/admin/deletecomment.php?id=16
http://www.example.com/blog/admin/deleteblog.php?id=15
An attacker may exploit these issues using a browser.
Sample exploit URIs have been provided:
http://www.example.com/blog/admin/deletecomment.php?id=16
http://www.example.com/blog/admin/deleteblog.php?id=15
Solution / Fix
geoBlog Multiple Security Bypass Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
geoBlog Multiple Security Bypass Vulnerabilities
References:
References: