Bludit Remote Code Execution Vulnerability (CNVD-2019-44571)

Bludit is an open source, lightweight blog content management system CMS. A remote code execution vulnerability exists in Bludit version 3.9.2, which can be exploited by remote attackers to execute code with the help of the bl-kernel/ajax/upload-images.php file...

CVE-2019-16113

Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname...

CVE-2019-16113

Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname...

Remote code execution

Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname...

CVE-2019-16113

Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname...

CVE-2019-16113

CVE-2019-16113 is a Bludit CMS vulnerability that allows remote code execution via an image upload function. In Bludit 3.9.2 and affected builds, the bl-kernel/ajax/upload-images.php flow can treat a crafted image filename (e.g., .jpg or .png) as PHP code, enabling the attacker to write PHP paylo...

Bludit 3.9.2 remote code execution

Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname. Recent assessments: wchen-r7 at October 24, 2019 4:38am UTC reported: CVE-2019-16113 Bludit...

CVE-2019-12742

Bludit prior to 3.9.1 allows a non-privileged user to change the password of any account, including admin. This occurs because of bl-kernel/admin/controllers/user-password.php Insecure Direct Object Reference a modified username POST parameter...

CVE-2019-12742

Bludit prior to 3.9.1 allows a non-privileged user to change the password of any account, including admin. This occurs because of bl-kernel/admin/controllers/user-password.php Insecure Direct Object Reference a modified username POST parameter...

Default credentials

Bludit prior to 3.9.1 allows a non-privileged user to change the password of any account, including admin. This occurs because of bl-kernel/admin/controllers/user-password.php Insecure Direct Object Reference a modified username POST parameter...

CVE-2019-12742

Bludit prior to 3.9.1 allows a non-privileged user to change the password of any account, including admin. This occurs because of bl-kernel/admin/controllers/user-password.php Insecure Direct Object Reference a modified username POST parameter...

CVE-2019-12742

Bludit prior to 3.9.1 is affected. A vulnerability in bl-kernel/admin/controllers/user-password.php allows a non-privileged user to change the password of any account (including admin) via an insecure direct object reference using a modified username POST parameter. Affected: Bludit content manag...

Bludit Remote Code Execution Vulnerability

Bludit is an open source, lightweight blog content management system CMS. A security vulnerability exists in Bludit versions prior to 3.9.0. An attacker can exploit the vulnerability to execute code by uploading a php file...

Remote code execution

Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php file while changing the logo through /admin/ajax/upload-logo...

CVE-2019-12548

Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php file while changing the logo through /admin/ajax/upload-logo...

CVE-2019-12548

Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php file while changing the logo through /admin/ajax/upload-logo...

CVE-2019-12548

Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php file while changing the logo through /admin/ajax/upload-logo...

CVE-2019-12548

Bludit before 3.9.0 is vulnerable to remote code execution by an authenticated user who uploads a PHP file while changing the site logo via /admin/ajax/upload-logo. Root cause: an upload path/permission issue allows execution of injected PHP. A fix is available in Bludit 3.9.0 (as referenced by r...

bludit Pages Editor 3.0.0 Arbitrary File Upload Vulnerability

Bludit is an open source and free lightweight blogging CMS Content Management System system.Pages Editor is one of the page editors. A security vulnerability exists in the content upload feature of Pages Editor in Bludit version 3.0.0, which stems from the program's failure to restrict the upload...

bludit Pages Editor 3.0.0 - Arbitrary File Upload

bludit Pages Editor 3.0.0 - Arbitrary File Upload Exploit Title: bludit Pages Editor 3.0.0 - Arbitrary File Upload Date: 2018-10-02 Google Dork: N/A Exploit Author: BouSalman Vendor Homepage: https://www.bludit.com/ Software Link: N/A Version: 3.0.0 Tested on: Ubuntu 18.04 CVE : 2018-1000811 POST...