Simple PHP Blog 'blog_language1' Parameter Local File Include Vulnerability
BID:37434
Info
Simple PHP Blog 'blog_language1' Parameter Local File Include Vulnerability
| Bugtraq ID: | 37434 |
| Class: | Input Validation Error |
| CVE: |
CVE-2009-4421 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 21 2009 12:00AM |
| Updated: | Apr 13 2015 09:05PM |
| Credit: | jgaliana from Internet Security Auditors |
| Vulnerable: |
Simple PHP Blog Simple PHP Blog 0.5.1 Simple PHP Blog Simple PHP Blog 0.5 Simple PHP Blog Simple PHP Blog 0.5.0.1 |
| Not Vulnerable: | |
Discussion
Simple PHP Blog 'blog_language1' Parameter Local File Include Vulnerability
Simple PHP Blog is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this vulnerability to obtain potentially sensitive information or to execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
Simple PHP Blog 0.5.1 is vulnerable; other versions may also be affected.
Simple PHP Blog is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this vulnerability to obtain potentially sensitive information or to execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
Simple PHP Blog 0.5.1 is vulnerable; other versions may also be affected.
Exploit / POC
Simple PHP Blog 'blog_language1' Parameter Local File Include Vulnerability
Attackers may exploit this issue through a browser.
The following exploit code is available:
Attackers may exploit this issue through a browser.
The following exploit code is available:
Solution / Fix
Simple PHP Blog 'blog_language1' Parameter Local File Include Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Simple PHP Blog 'blog_language1' Parameter Local File Include Vulnerability
References:
References:
- Simple PHP Blog Homepage (Simple PHP Blog)