Authentication flaw

2007-07-2722:30:00

PRIOn knowledge base

www.prio-n.com

7.7 High

AI Score

Confidence

Low

0.071 Low

EPSS

Percentile

94.0%

JSON

geoBlog (aka BitDamaged) 1 does not require authentication for (1) deletecomment.php, (2) deleteblog.php, and (3) listcomment.php in admin/, which allows remote attackers to delete arbitrary comments, delete arbitrary blogs, and have other unspecified impact via a request with a valid id parameter.

CPENameOperatorVersion
geoblogeq1

CPE	Name	Operator	Version
	geoblog	eq	1

References

osvdb.org/42485

osvdb.org/42486

osvdb.org/42487

securityreason.com/securityalert/2934

www.securityfocus.com/archive/1/474127/100/0/threaded

www.securityfocus.com/bid/24966

exchange.xforce.ibmcloud.com/vulnerabilities/35494