CVE-2019-12742: Authorization Bypass Through User-Controlled Key

Bludit prior to 3.9.1 allows a non-privileged user to change the password of any account, including admin. This occurs because of bl-kernel/admin/controllers/user-password.php Insecure Direct Object Reference a modified username POST parameter...

PT-2019-12912

Name of the Vulnerable Software and Affected Versions Bludit versions prior to 3.9.1 Description The issue allows a non-privileged user to change the password of any account, including admin, due to an Insecure Direct Object Reference in the bl-kernel/admin/controllers/user-password.php file. Thi...

Bludit Remote Code Execution Vulnerability

Bludit is an open source, lightweight blog content management system CMS. A security vulnerability exists in Bludit versions prior to 3.9.0. An attacker can exploit the vulnerability to execute code by uploading a php file...

Remote code execution

Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php file while changing the logo through /admin/ajax/upload-logo...

CVE-2019-12548

Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php file while changing the logo through /admin/ajax/upload-logo...

CVE-2019-12548

Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php file while changing the logo through /admin/ajax/upload-logo...

CVE-2019-12548

Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php file while changing the logo through /admin/ajax/upload-logo...

CVE-2019-12548

Bludit before 3.9.0 is vulnerable to remote code execution by an authenticated user who uploads a PHP file while changing the site logo via /admin/ajax/upload-logo. Root cause: an upload path/permission issue allows execution of injected PHP. A fix is available in Bludit 3.9.0 (as referenced by r...

CVE-2019-12548

Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php file while changing the logo through /admin/ajax/upload-logo...

CVE-2019-12548: Unrestricted Upload of File with Dangerous Type

Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php file while changing the logo through /admin/ajax/upload-logo...

PT-2019-12848

Name of the Vulnerable Software and Affected Versions Bludit versions prior to 3.9.0 Description The issue allows remote code execution for an authenticated user. This can be achieved by uploading a php file while changing the logo through the /admin/ajax/upload-logo API endpoint. Recommendations...

bludit Pages Editor 3.0.0 Arbitrary File Upload Vulnerability

Bludit is an open source and free lightweight blogging CMS Content Management System system.Pages Editor is one of the page editors. A security vulnerability exists in the content upload feature of Pages Editor in Bludit version 3.0.0, which stems from the program's failure to restrict the upload...

bludit Pages Editor 3.0.0 - Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: bludit Pages Editor 3.0.0 - Arbitrary File Upload Exploit Author: BouSalman Vendor Homepage: https://www.bludit.com/ Software Link: N/A Version: 3.0.0 Tested on: Ubuntu 18.04 CVE : 2018-1000811 POST /admin/ajax/upload-files...

bludit Pages Editor 3.0.0 - Arbitrary File Upload

bludit Pages Editor 3.0.0 - Arbitrary File Upload Exploit Title: bludit Pages Editor 3.0.0 - Arbitrary File Upload Date: 2018-10-02 Google Dork: N/A Exploit Author: BouSalman Vendor Homepage: https://www.bludit.com/ Software Link: N/A Version: 3.0.0 Tested on: Ubuntu 18.04 CVE : 2018-1000811 POST...

bludit Pages Editor 3.0.0 Shell Upload

Exploit Title: bludit Pages Editor 3.0.0 - Arbitrary File Upload Date: 2018-10-02 Google Dork: N/A Exploit Author: BouSalman Vendor Homepage: https://www.bludit.com/ Software Link: N/A Version: 3.0.0 Tested on: Ubuntu 18.04 CVE : 2018-1000811 POST /admin/ajax/upload-files HTTP/1.1 Host:...

Design/Logic Flaw

bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages Editor that can result in Remote Command Execution. This attack appear to be exploitable via malicious user have to upload a crafted payload containing PHP code...

CVE-2018-1000811

bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages Editor that can result in Remote Command Execution. This attack appear to be exploitable via malicious user have to upload a crafted payload containing PHP code...

CVE-2018-1000811

bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages Editor that can result in Remote Command Execution. This attack appear to be exploitable via malicious user have to upload a crafted payload containing PHP code...

CVE-2018-1000811

Bludit 3.0.0 Pages Editor content upload feature is vulnerable to Unrestricted Upload of File with Dangerous Type, enabling Remote Command Execution. A crafted payload containing PHP code uploaded via the Pages Editor can compromise the server. Public disclosures and mirrors (CNVD-2019-03580, NVD...

CVE-2018-1000811

bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages Editor that can result in Remote Command Execution. This attack appear to be exploitable via malicious user have to upload a crafted payload containing PHP code...